Parses a string into a timestamp.

This function is important for creating parsers, as it is used to parse the timestamp for an incoming event.

ParameterTypeRequiredDefault ValueDescription
addErrorsbooleanoptional[a]true Whether to add an error field to the event, if it was not possible to find a timestamp.
asstringoptional[a]@timestamp Name of output field that will contain the parsed timestamp. The timestamp is represented as milliseconds since 1970 in UTC. LogScale expects to find the timestamp in the field @timestamp, so do not change this when creating parsers.
caseSensitivebooleanoptional[a]true Whether the timestamp format pattern is case sensitive. For example, the format LLL will accept Feb but not feb in case sensitive mode, while both will be accepted in case insensitive mode.
   Valid Values
   falsePattern is not case sensitive
   truePattern is case sensitive
fieldstringrequired  The field holding the timestamp to be parsed.
format[b]stringoptional[a]yyyy-MM-ddTHH:mm:ss[.SSS]XXX Pattern used to parse the timestamp. Either a format string as specified in Java's DateTimeFormatter, or one of the special format specifiers (these specifiers are not case-sensitive, that is, MilliSeconds works as well).
   Valid Values
   millisEpoch time in milliseconds (UTC)
   millisecondsEpoch time in milliseconds (UTC)
   nanosEpoch time in nanoseconds (UTC)
   secondsEpoch time in seconds (UTC)
   unixTimeMillisEpoch time in milliseconds (UTC)
   unixTimeSecondsEpoch time in seconds (UTC)
timezonestringoptional[a]  If the timestamp does not contain a timezone, it can be specified using this parameter. Examples are Europe/London, America/New_York and UTC. See the full list of timezones supported by LogScale at Supported Time Zones. Note that if the timestamp does not contain a timezone, and no timezone is specified here, an error is generated. If the timezone is specified here, and one also exists in the timestamp, then this parameter overrides the timezone in the event.
timezoneAsstringoptional[a]@timezone Name of output field that will contain the parsed timezone. LogScale expects to find the timezone in the field @timezone , so do not change when creating parsers.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name format can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Before parsing the timestamp, the part of the log containing the timestamp should have been captured in a field. Typically this is done during parsing, but can be extracted during queries using functions like regex() and parseJson() before parseTimestamp().

The parseTimestamp() function formats times using a subset of Java's DateTimeFormatter.

LogScale also supports some special format strings like seconds, milliseconds, and unixtime (see in table below the description of the format parameter for a full list of options).

  • unixtimeMillis UTC time since 1970 in milliseconds

  • unixtime UTC time since 1970 in seconds

For the special formats that specify seconds (that is seconds, unixtime, and unixtimeseconds), the function also supports specifying milliseconds using floating point numbers.

For example, 1690480444.589 means 2023-07-27 19:54:04 and 589 milliseconds.

If the timestamp is parsed it will create a field @timestamp containing the parsed timestamp in UTC milliseconds and a @timezone field containing the original timezone.

It is possible to parse time formats leaving out the year designator as is sometime seen in time formats from Syslog. For example Mar 15 07:48:13 can be parsed using the format MM d HH:mm:ss. In this case LogScale will guess the year.

Extract a timestamp that is using millisecond precision embedded in a JSON value:

logscale
parseJson()
| parseTimestamp("millis", field=timestamp)

Events having a timestamp in ISO8601 format that include a timezone offset can be parsed using the default format:

logscale
expiryTime := "2018-09-08 17:51:04.777Z"
| parseTimestamp(field=expiryTime)

Another example is a timestamp like 2017-12-18T20:39:35-04:00:

logscale
/(?<timestamp>\S+)/
| parseTimestamp(field=timestamp)

Parse timestamps in an accesslog where the timestamp includes an explicit timezone offset like 192.168.1.19 [02/Apr/2014:16:29:32 +0200] GET /hello/test/123 ...

logscale
/(?<client>\S+) \[(?<@timestamp>.+)\] (?<method>\S+) (?<url>\S+)/
| parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z", field=timestamp)

When parsing a timestamp without a timezone, such as 2015-12-18T20:39:35, you must specify the timezone using the timezone parameter, as shown in the following example:

logscale
parseTimestamp("yyyy-MM-ddTHH:mm:ss", field=timestamp, timezone="America/New_York")

Important

If the timestamp does not contain a timezone, then one must be specified using the timezone parameter, otherwise an error is generated.

Parse an event with a timestamp not containing year, like Feb 9 12:22:44 hello world

logscale
/(?<timestamp>\S+\s+\S+\s+\S+)/
| parseTimestamp("MMM [ ]d HH:mm:ss", field=timestamp, timezone="Europe/London")