date

Overview

Adds a default timestamp to the event or parses timestamp fields, and converts it to ISO 8601 format, which can be used as event timestamp.

OptionRequiredTypeDescription
matchConditionallyListList of key and patterns where patterns is a list. The list of match can have exactly one key and patterns. There is no default value. This option cannot be defined at the same time as from_time_received. Include multiple date processors in your pipeline if both options should be used.
from_time_receivedConditionallyBooleanA boolean that is used for adding default timestamp to event data from event metadata which is the time when source receives the event. Default value is false. This option cannot be defined at the same time as match. Include multiple date processors in your pipeline if both options should be used.
destinationNoStringField to store the timestamp parsed by date processor. It can be used with both match and from_time_received. Default value is @timestamp.
source_timezoneNoStringTime zone used to parse dates. It is used in case the zone or offset cannot be extracted from the value. If the zone or offset are part of the value, then timezone is ignored. Find all the available timezones the list of database time zones in the TZ database name column.
destination_timezoneNoStringTimezone used for storing timestamp in destination field. The available timezone values are the same as source_timestamp.
localeNoStringLocale is used for parsing dates. It’s commonly used for parsing month names(MMM). It can have language, country and variant fields using IETF BCP 47 or String representation of Locale object. For example en-US for IETF BCP 47 and en_US for string representation of Locale. Full list of locale fields which includes language, country and variant can be found the language subtag registry. Default value is Locale.ROOT.