The time module is used to convert Timestamp enumerated values into formatted strings, and vice versa. For example, the following will print each entry’s built-in timestamp value using the specified format and save the result as a string in a new enumerated value named “formattedTS”:

time -f "Mon Jan _2 15:04:05 2006 MST" TIMESTAMP formattedTS

If the first enumerated value argument is a string rather than a timestamp, the module will instead attempt to parse the string as a time and save the output into a Timestamp enumerated value. Note that if no specific format is given, the module will use the timegrinder library to try many possibilities. The following will look at a string enumerated value named “tsString” and attempt to convert it to a timestamp, placing the result in “extractedTS” if successful.

time tsString extractedTS

Supported Options#

  • -f <format>: Specifies the format to be used when printing timestamps or optionally when parsing strings. The format consists of a string representation of a specific time, “Mon Jan 2 15:04:05 MST 2006”, as used by the Go time library. For instance, one may say -f "Mon 3:04PM" to get a very brief timestamp format. Refer to the linked documentation for more examples.

  • -tz <timezone>: Specifies a time zone, in tz database format, e.g. “America/Denver”, “UTC”, or “Atlantic/Reykjavik”. This time zone will be used when printing timestamps (which do not have a time zone associated with them) and when parsing strings which do not contain a time zone specification.

Note on the use of the -f flag#

The -f (format) flag has a different behavior depending on the underlying type of the enumerated value being used as input. If the enumerated value is a timestamp, such as the built-in TIMESTAMP EV, -f sets the output format for the output enumerated value. Conversely, if the input enumerated value is a string, the -f flag is used to tell the time module what format the timestamp is in (not using the flag will invoke the lower performance “timegrinder” approach).


To print entry timestamps in a specific format and time zone:

tag=json time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" TIMESTAMP foo | table TIMESTAMP foo

The output of the previous module invocation can be fed back in to the time module to convert back into timestamps:

tag=json time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" TIMESTAMP foo | time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" foo bar | table TIMESTAMP foo bar

Note that the fractional seconds are truncated in the final output, because the intermediate time format does not include them.