Rewrite Timestamp

Description

The Rewrite Timestamp processor can be used to write the value from the Time field of a telemetry entry into a string value.

Supported Types

Metrics	Logs	Traces
✓	✓	✓

Configuration

Field	Description
Condition	A condition that determines when this processor is applied.
Target Field Type	The telemetry field type where the newly formatted timestamp will be placed.
Target Field	The target field to place the result into. May only be blank if Body is selected for the Target Field Type.
Timestamp Format	The ctime variable based timestamp format to write.

Example Configuration(s)

Rewriting the timestamp of a syslog message that has first been parsed using regex, and the timestamp value parsed into the Time field.

Processors

This processor is frequently part of a chain that involves parsing the original message, parsing the timestamp into the Time field, rewriting that timestamp from the Time field back into a string, and then concatenating the parsed strings back together.

Attributes created by the processors above

The new_ts field is what was created by the rewrite.

Rewrite Timestamp Processor Config