Date/Time Modifiers

Below is a set of modifiers that can be used with the RECEIVED field to transform it to the required date/time format.

For the examples below, the {RECEIVED} field equals ISO formatted 2023-04-01T09:20:01.000000-0700.

Date Format

Spec Description

%y

The last two decimal digits of the year.

%Y

The year as a decimal number.

%b

Abbreviated month name.

%B

Full month name.

%m

Month as a decimal number (January is 01), prefixed with 0 if needed.

%d

Day of the month as a decimal number, prefixed with 0 if needed.

%e

Day of the month as a decimal number, prefixed with a space if needed.

%D

Equivalent to "%m/%d/%y".

%F

Equivalent to "%Y-%m-%d".

{RECEIVED|%B %e, %Y} converts to April 1, 2023
{RECEIVED|%F} converts to 2023-04-01

Weekday Format

Spec Description

%a

Abbreviated weekday name.

%A

Full weekday name.

%u

Weekday as a decimal number (1-7), where Monday is 1.

%w

Weekday as a decimal number (0-6), where Sunday is 0.

{RECEIVED|%A} converts to Saturday

Time Format

Spec Description

%H

Hour (24-hour clock) as a decimal number, prefixed with 0 if needed.

%I

Hour (12-hour clock) as a decimal number, prefixed with 0 if needed.

%p

Locale’s equivalent of the AM/PM designations associated with a 12-hour clock.

%M

Minutes as a decimal number, prefixed with 0 if needed.

%S

Seconds as a decimal number (prefixed with 0 if needed) followed by the fractional part of the second, if present in the timestamp.

%T

Equivalent to "%H:%M:%S".

{RECEIVED|%I:%M:%S %p} converts to 09:20:01.000000 AM
{RECEIVED_S|%I:%M:%S %p} converts to 09:20:01 AM

Timezone Format

Spec Description

%Z

Time zone abbreviation.

%z

Offset from UTC, e.g. -0430 means 4 hours 30 minutes behind UTC. +0000 if the offset is zero.

%Ez

Same as %z with a : between the hours and minutes (e.g., -04:30).

Miscellaneous

Spec Description

%Q

Microseconds since UNIX epoch (January 1, 1970 00:00:00 UTC). It is also a unique message identifier in the syslog storage.

%j

Day of the year as a decimal number (January 1 is 001). It is left-padded with 0 to three digits.

%U

Week number of the year as a decimal number, prefixed with 0 if needed. The first Sunday of the year is the first day of week 01. Days of the same year prior to that are in week 00.

%W

Week number of the year as a decimal number, prefixed with 0 if needed. The first Monday of the year is the first day of week 01. Days of the same year prior to that are in week 00.

%x

Locale’s date representation.

%c

Locale’s date and time (rounded to seconds) representation.

{RECEIVED|%Q} converts to 1680366001000000
{RECEIVED|%j} converts to 091