Parse RFC3339Nano Date to @timestamp field


(rucciva noneedtoknow) #1

How do you parse time that is formatted using golang's RFC3339Nano into @timestamp field?


(Magnus Bäck) #2

It'll be easier to help if you post an example.


(rucciva noneedtoknow) #3

Here's one of the example
"2006-01-02T15:04:05.999999999Z07:00"


(Magnus Bäck) #4

Is that a real example? I thought those timestamps can end with "Z" or a UTC offset, not both.

The @timestamp field doesn't have more than millisecond precision and I'm not sure the date filter is able to parse nanoseconds.


(rucciva noneedtoknow) #5

Iyap. I just copy paste that from the golang time package documentation.

Is there any way to remove the nano second part first and then parse it using date filter?


(Magnus Bäck) #6

Is there any way to remove the nano second part first and then parse it using date filter?

Sure, you can e.g. use a mutate filter's gsub option.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.