Date/Time Modifiers
Below is a set of modifiers that can be used with the RECEIVED field to transform it to the required date/time format.
For the examples below, the {RECEIVED} field equals ISO formatted 2023-04-01T09:20:01.000000-0700.
Date Format
| Spec | Description |
|---|---|
|
The last two decimal digits of the year. |
|
The year as a decimal number. |
|
Abbreviated month name. |
|
Full month name. |
|
Month as a decimal number (January is 01), prefixed with 0 if needed. |
|
Day of the month as a decimal number, prefixed with 0 if needed. |
|
Day of the month as a decimal number, prefixed with a space if needed. |
|
Equivalent to "%m/%d/%y". |
|
Equivalent to "%Y-%m-%d". |
{RECEIVED|%B %e, %Y} converts to April 1, 2023
{RECEIVED|%F} converts to 2023-04-01
Weekday Format
| Spec | Description |
|---|---|
|
Abbreviated weekday name. |
|
Full weekday name. |
|
Weekday as a decimal number (1-7), where Monday is 1. |
|
Weekday as a decimal number (0-6), where Sunday is 0. |
{RECEIVED|%A} converts to Saturday
Time Format
| Spec | Description |
|---|---|
|
Hour (24-hour clock) as a decimal number, prefixed with 0 if needed. |
|
Hour (12-hour clock) as a decimal number, prefixed with 0 if needed. |
|
Locale’s equivalent of the AM/PM designations associated with a 12-hour clock. |
|
Minutes as a decimal number, prefixed with 0 if needed. |
|
Seconds as a decimal number (prefixed with 0 if needed) followed by the fractional part of the second, if present in the timestamp. |
|
Equivalent to "%H:%M:%S". |
{RECEIVED|%I:%M:%S %p} converts to 09:20:01.000000 AM
{RECEIVED_S|%I:%M:%S %p} converts to 09:20:01 AM
Timezone Format
| Spec | Description |
|---|---|
|
Time zone abbreviation. |
|
Offset from UTC, e.g. -0430 means 4 hours 30 minutes behind UTC. +0000 if the offset is zero. |
|
Same as |
Miscellaneous
| Spec | Description |
|---|---|
|
Microseconds since UNIX epoch (January 1, 1970 00:00:00 UTC). It is also a unique message identifier in the syslog storage. |
|
Day of the year as a decimal number (January 1 is 001). It is left-padded with 0 to three digits. |
|
Week number of the year as a decimal number, prefixed with 0 if needed. The first Sunday of the year is the first day of week 01. Days of the same year prior to that are in week 00. |
|
Week number of the year as a decimal number, prefixed with 0 if needed. The first Monday of the year is the first day of week 01. Days of the same year prior to that are in week 00. |
|
Locale’s date representation. |
|
Locale’s date and time (rounded to seconds) representation. |
{RECEIVED|%Q} converts to 1680366001000000
{RECEIVED|%j} converts to 091