Parses a string into a timestamp.

This function is important for creating parsers, as it is used to parse the timestamp for an incoming event.

Before parsing the timestamp, the part of the log containing the timestamp should be captured into a field. This is done using functions like regex() and parseJson() before parseTimestamp.

The format string is specified using Java's DateTimeFormatter. LogScale also supports specifying the following in the format string:

  • unixtimeMillis UTC time since 1970 in milliseconds

  • unixtime UTC time since 1970 in seconds

If the timestamp is parsed it will create a field @timestamp containing the parsed timestamp in UTC milliseconds and a @timezone field containing the original timezone.

It is possible to parse time formats leaving out the year designator as is sometime seen in time formats from Syslog. For example Mar 15 07:48:13 can be parsed using the format MM d HH:mm:ss. In this case LogScale will guess the year.

ParameterTypeRequiredDefaultDescription
addErrorsbooleanfalsetrueWhether to add an error field to the event, if it was not possible to find a timestamp.
asstringfalse@timestampName of output field that will contain the parsed timestamp. The timestamp is represented as milliseconds since 1970 in UTC. LogScale expects to find the timestamp in the field @timestamp, so do not change this when creating parsers.
caseSensitivebooleanfalsetrueWhether the timestamp format pattern is case sensitive. For example, the format LLL will accept Feb but not feb in case sensitive mode, while both will be accepted in case insensitive mode.
  Valid ValuesfalsePattern is not case sensitive
   truePattern is case sensitive
fieldstringtrue The field holding the timestamp to be parsed.
formatstringfalseyyyy-MM-dd'T'HH:mm:ss[.SSS]XXXPattern used to parse the timestamp. The format string is specified using Java's DateTimeFormatter.
  Valid ValuesmillisEpoch time in milliseconds (UTC)
   secondsEpoch time in seconds (UTC)
   unixTimeSecondsEpoch time in seconds (UTC)
   unixTimemillisEpoch time in milliseconds (UTC)
timezonestringfalse If the timestamp does not contain a timezone, it can be specified using this parameter. Example are Europe/London, America/New_York and UTC. See the full list of timezones supported by LogScale at Supported Timezones.
timezoneAsstringfalse@timezoneName of output field that will contain the parsed timezone. LogScale expects to find the timezone in the field @timezone , so do not change when creating parsers.

Events having a timestamp in ISO8601 format can be parsed using the default format.

An example is a timestamp like 2017-12-18T20:39:35Z:

logscale
/(?<timestamp>\S+)/
| parseTimestamp(field=timestamp)

Parse timestamps in an accesslog where the timestamp includes an explicit timezone offset like 192.168.1.19 [02/Apr/2014:16:29:32 +0200] GET /hello/test/123 ...

logscale
/(?<client>\S+) \[(?<@timestamp>.+)\] (?<method>\S+) (?<url>\S+)/
| parseTimestamp("dd/MMM/yyyy:HH:mm:ss Z", field=timestamp)

When parsing a timestamp without a timezone like 2015-12-18T20:39:35 you should declare to LogScale what timezone a given time should be located:

logscale
parseTimestamp("yyyy-MM-dd'T'HH:mm:ss", field=timestamp, timezone="America/New_York")

Parse an event with a timestamp not containing year like Feb 9 12:22:44 hello world

logscale
/(?<timestamp>\S+\s+\S+\s+\S+)/
| parseTimestamp("MM [ ]d HH:mm:ss", field=timestamp, timezone="Europe/London")