Pipeline rule date parse

(JK) #1


my input timestamp is April 22 2018 11:11:56 PM EDT How i can write parsedate inpipeline rule .

For Example:

For todays date : 2018-04-25 10:10:06 AM IST i am writing like below

let new_date = parse_date( to_string($message.timestamp),
“yyyy-MM-dd HH:mm:ss”,
set_field(“timestamp”, new_date);

How i can write for
April 22 2018 11:11:56 PM EDT


(Jan Doberstein) #2

you would need to rewrite the format that it will match your date string according to the time parser


(Jo ) #3

Hi - in a situation where the logs have two different formats: yyyy-MM-dd HH:mm:ss and yyyy-MM-dd HH:mm:ss.SSSSSS, how do I write rules to check which format is being processed and parse accordingly?

(Jochen) #4

You could use the regex() function to match the input against the expected date format.

Messages not routing into stream
(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.