How can all timestamps in a message be converted like the first?


1 comment

  • Avatar
    Dwayne Hoover

    Here is an example using a few unpublished operators:

    * | parse regex "^(?<new\_date>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s).+$"

    | toMillis(parseDate(new_date,"yyyy-MM-dd HH:mm:ss")) as etime

    | formatDate(fromMillis(toLong(etime)),"yyyy-MM-dd HH:mm:ss.SSS ZZZZ") as end_time_mod

    A quick tour of what's happening:

    I'm using a parse regex to pull out the date.  This could be the true timestamp or a secondary date, for illustration purposes, I'm grabbing the first date in the log message.

    I'm using parseDate to convert the date that I extracted into a numerical representation of the date.  I am also using the toMillis function to convert it into a millisecond date format.

    I can then use the formatDate operator to to convert the millisecond based date into a string (of any Java compliant format)


    Comment actions Permalink

Please sign in to leave a comment.