Time and Date

ISO8601

Matches timestamp in the form of yyyy-MM-ddTHH:mm:ssZ

Example

Parsing date time string raw_text with pattern expression ISO8601:parsed_timestamp:

HTTPDATE

Matches timestamp in the form of dd/MMM/yyyy:HH:mm:ss Z

Example

Parsing date time string raw_text with pattern expression HTTPDATE:parsed_timestamp:

JSONTIMESTAMP

Matches timestamp in the form of yyyy-MM-ddTHH:mm:ss.SSSZ

Example

Parsing date time string raw_text with pattern expression JSONTIMESTAMP:parsed_timestamp:

TIMESTAMP, TIME

Allows parsing time and date fields in any format with millisecond precision.

Example

Parsing following date-time with day abbreviations in German:

Do, 24 Mai 2018 14:30:34 CET
Fr, 25 Mai 2018 09:01:00 CET

We can use pattern specifying German locale:
TIMESTAMP('EEE, d MMM yyyy HH:mm:ss Z', locale='de'):parsed_timestamp EOL:

Unix Timestamp (Epoch)

Conversion Patterns

Parsing date and time mean correctly assigning value to a timestamp - information describing a point in time. Log processing keeps timestamps similarly to Unix time (or epoch time) values - defined as the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), Thursday, 1 January 1970.

Time parsing is backed by the Java Calendar class. Depending on user Locale settings the Calendar may be Gregorian or locale-specific. Time and Date pattern behavior may be specific to the Calendar instance.

Pattern letters are usually repeated, as their number determines the exact presentation:

Text

If the number of pattern letters is 4 or more, the full name of a field is expected by the parser. Otherwise, the abbreviated name is expected. For instance pattern "EE" expects the abbreviated name of the day in a week, such as "Tue".

Numeric

Digits 0 - 9, leading zeroes and spaces are allowed. Depending on the number of letters in pattern specification, the behavior of parser is as follows:

Year

Numeric data is allowed only. If the calendar is Gregorian then:

If the calendar is not Gregorian and the number of pattern letters is 4 or more, a calendar specific long form is used. Otherwise, calendar specific short form is used.

Month

If the number of pattern letters is 3 or more, the month is interpreted as text, otherwise as numeric:

Unnecessary

intended for skipping numeric parts of time and date, which do not contribute to timestamp computation. For example the number of the day in a week. These parts of the timestamp will be parsed as follows, but are ignored in the computation of timestamp value.

Milliseconds

The number of milliseconds. Accepts numeric values up to 9 digits. The values exceeding 999 are divided by 10, 100, 1000 or 1000000 respectively to the number of digits. The remainder of the division is used as a fractional part representing milliseconds, and the quotient is added to the main timestamp.

The single letter 'S' matches variable-length value up to 9 digits. The pattern with up to 9 letters of 'S' matches values up to the respective number of digits.

Example

Parsing time and date using pattern TIMESTAMP('yyyy-MM-dd HH:mm:ss.S', tz='UTC'):

Fractional_second

The fraction of a second. Single 'f' letter matches numeric values up to 9 digits.

When used with matcherdef-timestamp then only up to 3 most significant digits from the value are used.

When used with matcherdef-timestamp_nano then all digits are used (effectively representing the number of nanoseconds).

Example

Parsing following date-time string raw_text with following patterns:

TIMESTAMP('yyyy-MM-dd HH:mm:ss.f', tz='UTC'):parsed_timestamp

Timezone

parses time zone expressed as timezone full name or abbreviation in English (see https://www.timeanddate.com/time/zones/)

Example

Parsing following date string to UTC timezone:

2019-01-05 13:14:25

we need to use the pattern:

TIMESTAMP('yyyy-MM-dd HH:mm:ss', timezone='UTC'):datetime

Results in parsing line 1 into datetime field as follows:

Examples

The result of parsing is displayed here in the UTC timezone.