The time module is used to convert Timestamp enumerated values into formatted strings, and vice versa. For example, the following will print each entry’s built-in timestamp value using the specified format and save the result as a string in a new enumerated value named “formattedTS”:
time -f "Mon Jan _2 15:04:05 2006 MST" TIMESTAMP formattedTS
If the first enumerated value argument is a string rather than a timestamp, the module will instead attempt to parse the string as a time and save the output into a Timestamp enumerated value. Note that if no specific format is given, the module will use the
timegrinder library to try many possibilities. The following will look at a string enumerated value named “tsString” and attempt to convert it to a timestamp, placing the result in “extractedTS” if successful.
time tsString extractedTS
-f <format>: Specifies the format to be used when printing timestamps or optionally when parsing strings. The format consists of a string representation of a specific time, “Mon Jan 2 15:04:05 MST 2006”, as used by the Go time library. For instance, one may say
-f "Mon 3:04PM"to get a very brief timestamp format. Refer to the linked documentation for more examples.
-tz <timezone>: Specifies a time zone, in tz database format, e.g. “America/Denver”, “UTC”, or “Atlantic/Reykjavik”. This time zone will be used when printing timestamps (which do not have a time zone associated with them) and when parsing strings which do not contain a time zone specification.
Note on the use of the
-f (format) flag has a different behavior depending on the underlying type of the enumerated value being used as input. If the enumerated value is a timestamp, such as the built-in TIMESTAMP EV,
-f sets the output format for the output enumerated value. Conversely, if the input enumerated value is a string, the
-f flag is used to tell the time module what format the timestamp is in (not using the flag will invoke the lower performance “timegrinder” approach).
To print entry timestamps in a specific format and time zone:
tag=json time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" TIMESTAMP foo | table TIMESTAMP foo
The output of the previous module invocation can be fed back in to the time module to convert back into timestamps:
tag=json time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" TIMESTAMP foo | time -f "Mon Jan _2 15:04:05 2006 MST" -tz "America/Chicago" foo bar | table TIMESTAMP foo bar
Note that the fractional seconds are truncated in the final output, because the intermediate time format does not include them.