Date/Time Modifiers¶
Below is a set of modifiers that can be used with the RECEIVED field to transform it to the required date/time format.
For the examples below, the {RECEIVED} field equals ISO formatted 2023-04-01T09:20:01.000000-0700.
Date Format¶
| Spec | Description |
|---|---|
%y |
The last two decimal digits of the year. |
%Y |
The year as a decimal number. |
%b |
Abbreviated month name. |
%B |
Full month name. |
%m |
Month as a decimal number (January is 01), prefixed with 0 if needed. |
%d |
Day of the month as a decimal number, prefixed with 0 if needed. |
%e |
Day of the month as a decimal number, prefixed with a space if needed. |
%D |
Equivalent to "%m/%d/%y". |
%F |
Equivalent to "%Y-%m-%d". |
Example
{RECEIVED|%B %e, %Y} converts to April 1, 2023
{RECEIVED|%F} converts to 2023-04-01
Weekday Format¶
| Spec | Description |
|---|---|
%a |
Abbreviated weekday name. |
%A |
Full weekday name. |
%u |
Weekday as a decimal number (1-7), where Monday is 1. |
%w |
Weekday as a decimal number (0-6), where Sunday is 0. |
Example
{RECEIVED|%A} converts to Saturday
Time Format¶
| Spec | Description |
|---|---|
%H |
Hour (24-hour clock) as a decimal number, prefixed with 0 if needed. |
%I |
Hour (12-hour clock) as a decimal number, prefixed with 0 if needed. |
%p |
Locale's equivalent of the AM/PM designations associated with a 12-hour clock. |
%M |
Minutes as a decimal number, prefixed with 0 if needed. |
%S |
Seconds as a decimal number (prefixed with 0 if needed) followed by the fractional part of the second, if present in the timestamp. |
%T |
Equivalent to "%H:%M:%S". |
Example
{RECEIVED|%I:%M:%S %p} converts to 09:20:01.000000 AM
{RECEIVED_S|%I:%M:%S %p} converts to 09:20:01 AM
Timezone Format¶
| Spec | Description |
|---|---|
%Z |
Time zone abbreviation. |
%z |
Offset from UTC, e.g. -0430 means 4 hours 30 minutes behind UTC. +0000 if the offset is zero. |
%Ez |
Same as %z with a : between the hours and minutes (e.g., -04:30). |
Miscellaneous¶
| Spec | Description |
|---|---|
%Q |
Microseconds since UNIX epoch (January 1, 1970 00:00:00 UTC). It is also a unique message identifier in the syslog storage. |
%j |
Day of the year as a decimal number (January 1 is 001). It is left-padded with 0 to three digits. |
%U |
Week number of the year as a decimal number, prefixed with 0 if needed. The first Sunday of the year is the first day of week 01. Days of the same year prior to that are in week 00. |
%W |
Week number of the year as a decimal number, prefixed with 0 if needed. The first Monday of the year is the first day of week 01. Days of the same year prior to that are in week 00. |
%x |
Locale's date representation. |
%c |
Locale's date and time (rounded to seconds) representation. |
Example
{RECEIVED|%Q} converts to 1680366001000000
{RECEIVED|%j} converts to 091