Skip to main content
Version: User Guide 6.5

Date/Time Modifiers

Date/Time for Examples

Let the {RECEIVED} field equals April 1, 2023, 09:20:01 for examples below.

Date Format

SpecDescription
%yThe last two decimal digits of the year.
%YThe year as a decimal number.
%bAbbreviated month name.
%BFull month name.
%mMonth as a decimal number (January is 01), prefixed with 0 if needed.
%dDay of month as a decimal number, prefixed with 0 if needed.
%eDay of month as a decimal number, prefixed with a space if needed.
%DEquivalent to "%m/%d/%y".
%FEquivalent to "%Y-%m-%d".
Examples

{RECEIVED|%B %e, %Y} converts to April 1, 2023
{RECEIVED|%F} converts to 2023-04-01

Weekday Format

SpecDescription
%aAbbreviated weekday name.
%AFull weekday name.
%uWeekday as a decimal number (1-7), where Monday is 1.
%wWeekday as a decimal number (0-6), where Sunday is 0.
Examples

{RECEIVED|%A} converts to Saturday

Time Format

SpecDescription
%HHour (24-hour clock) as a decimal number, prefixed with 0 if needed.
%IHour (12-hour clock) as a decimal number, prefixed with 0 if needed.
%pLocale's equivalent of the AM/PM designations associated with a 12-hour clock.
%MMinutes as a decimal number, prefixed with 0 if needed.
%SSeconds as a decimal number (prefixed with 0 if needed) followed by the fractional part of the second, if present in the timestamp.
%TEquivalent to "%H:%M:%S".

Timezone Format

SpecDescription
%ZTime zone abbreviation.
%zOffset from UTC, e.g. for example -0430 means 4 hours 30 minutes behind UTC. +0000 if the offset is zero.
%EzSame as %z with a : between the hours and minutes (e.g., -04:30).

Miscellaneous

SpecDescription
%QMicroseconds since UNIX epoch (January 1, 1970 00:00:00 UTC). It is also a unique message identifier in the syslog storage. %Q should be the only spec to work correctly.
%jDay of the year as a decimal number (January 1 is 001). It is left-padded with 0 to three digits.
%UWeek number of the year as a decimal number, prefixed with 0 if needed. The first Sunday of the year is the first day of week 01. Days of the same year prior to that are in week 00.
%WWeek number of the year as a decimal number, prefixed with 0 if needed. The first Monday of the year is the first day of week 01. Days of the same year prior to that are in week 00.
%xLocale's date representation.
%cLocale's date and time (rounded to seconds) representation.