For the complete documentation index, see llms.txt. This page is also available as Markdown.

Parse Timestamp

The Parse Timestamp processor reads a timestamp from a field and sets it as the record's own timestamp. It supports automatic format detection, strptime layouts, epoch values, timezone and locale, and pulling a timestamp out of a longer field with a regex.

Supported Telemetry Types

Logs
Metrics
Traces
Bindplane Collector

v1.36.0+

The processor runs only on the signals you select in Choose Telemetry Type. Each selected signal is configured independently in its own section.

Configuration

Basic Configuration

Bindplane docs - Parse Timestamp - image 1

The simplest setup points the processor at a field that already holds a clean timestamp and lets format detection do the rest.

Parameter
Type
Required
Default
Description

Choose Telemetry Type

Telemetry Selector

No

Logs

The signals (Logs, Metrics, Traces) this processor applies to. Defaults to Logs.

Log Field Type

Enum

Yes

Attribute

Where the source timestamp lives: Resource, Attribute, or Body.

Source Field

OTTL Field

No

(empty)

The field the timestamp is read from. Leave empty with Body to parse a timestamp from the whole body string.

Log Time Format

Enum

No

Auto

How the source timestamp is formatted: Auto, RFC3339, ISO8601, Epoch, or Manual. Auto detects RFC3339, ISO8601, and epoch values.

Body is offered for the Logs context only. Metrics and traces have no body, so their Field Type is limited to Resource and Attribute.

Extracting From a Longer Field

When the source field holds more than just a timestamp (a raw syslog line, an unparsed message), use a regex to pull the timestamp out before parsing.

Parameter
Type
Required
Default
Description

Extract Regex

String

No

(empty)

A regular expression with a named capture group. The first named group is used as the timestamp. Leave empty to parse the whole source field.

For example, (?P<ts>\w+ \d+ \d+:\d+:\d+) pulls Oct 11 22:14:15 out of a longer log line, and only that substring is parsed.

Timestamp Format

Parameter
Type
Required
Default
Description

Epoch Layout

Enum

Yes (when Time Format is Epoch)

auto

Granularity of an epoch value: auto, s, ms, us, ns, s.ms, s.us, s.ns. auto detects it from the value.

Timestamp Layout

String

Yes (when Time Format is Manual)

%Y-%m-%dT%H:%M:%S.%f%z

The strptime layout the timestamp is written in.

Timezone and Locale

These apply when the Time Format is Auto, ISO8601, or Manual. They are hidden for RFC3339 and Epoch, which carry their own zone or are absolute.

Parameter
Type
Required
Default
Description

Location

Timezone

No

(empty)

The timezone to interpret the timestamp in, used only when the timestamp carries no zone of its own. If the timestamp already includes a zone, that zone wins.

Locale

Locale

No

(empty)

The locale the timestamp is written in, for non-English month and day names (for example fr-FR).

Condition

Parameter
Type
Required
Default
Description

Condition

OTTL Condition

No

(empty)

An OTTL condition that must be true for the processor to run. Empty applies it to every record of the selected signal.

Metrics and Traces

Metrics and Traces expose the same parameters as Logs (Source Field, Extract Regex, Time Format, Epoch Layout, Timestamp Layout, Location, Locale, Condition), scoped to their own section. Two differences:

  • Field Type is limited to Resource and Attribute (no Body).

  • Source Field is required.

Examples

Pulling a timestamp out of a raw log body

Bindplane docs - Parse Timestamp - image 2

The body is an unparsed syslog line. The named-group regex extracts the Oct 11 22:14:15 portion, and the Manual layout parses it as the record's timestamp.

Parsing an epoch field with auto-detected granularity

Bindplane docs - Parse Timestamp - image 3

Epoch with auto reads a numeric timestamp and detects whether it is seconds, milliseconds, microseconds, or nanoseconds from its magnitude, so the same configuration handles sources that disagree on precision.

Configuration Tips

Choosing a format

  • Start with Auto. It covers RFC3339, ISO8601, and epoch values, which is most of what you will see.

  • Reach for Manual only when the timestamp is in a fixed, non-standard layout, and write that layout with strptime directives.

Location vs. an embedded zone

  • Location is a fallback, not an override. It is applied only when the parsed timestamp has no zone of its own. A timestamp that already ends in Z or +02:00 keeps that zone regardless of Location.

Extract Regex

  • The capture group must be named ((?P<name>…)); the first named group is the timestamp. A regex with no named group is ignored and the whole field is parsed.

Troubleshooting

The record timestamp isn't changing

Symptoms: Records pass through unchanged; the timestamp is still the ingest/observed time.

Solutions:

  1. Confirm the Source Field actually holds the value. With Body and an empty Source Field, the whole body must be a string.

  2. If you set an Extract Regex, confirm it matches the field and has a named group. A non-match leaves the timestamp untouched.

  3. With Manual, check the Timestamp Layout against the real value, directive by directive. A single mismatched directive (for example %d vs %e for a space-padded day) causes the parse to fail silently.

The parsed time is off by hours

Symptoms: The timestamp parses but lands in the wrong timezone.

Solutions:

  1. If the source timestamp has no zone, set Location to the zone the data was produced in.

  2. If it does have a zone, remove Location — it is ignored in that case, and a stale value can mislead.

Standalone Processor

What Changed in This Version

This release updates the regex extraction and the timezone/locale inputs:

  • Single named-group regex. The separate Extract Regex + Extract Group parameters are replaced by one Extract Regex. Put a named capture group in the pattern ((?P<ts>…)); the first named group is used. Existing configs that set both fields should move the pattern into Extract Regex and name the group.

  • Timezone and Locale are now pickers, not free-text strings. They accept the same values as before (IANA zone names, locale codes), now validated against a dropdown.

  • Whole-body parsing. With Body selected and Source Field left empty, the processor now parses the entire body string, so you can pull a timestamp straight out of a raw log line with Extract Regex instead of staging it into an attribute first.

Bindplane Resources

Last updated

Was this helpful?