Rewrite Timestamp

The Rewrite Timestamp processor reformats a log's timestamp and writes it to an attribute or back into the body. It can also parse a timestamp string out of a field first (with timezone and locale) and rewrite it in place.

Supported Telemetry Types

Logs	Metrics	Traces
✓

Rewrite Timestamp is logs-only. The use case is reshaping a timestamp that lives in the log itself, the body or an attribute. Setting a record's canonical timestamp from a field is the job of Parse Timestamp, which also covers metrics and traces.

Configuration

Basic Configuration

The simplest setup takes the log's existing timestamp and writes a formatted copy into an attribute, no parsing involved.

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	Fixed to Logs for this processor.
Source	Enum	No	Time	Where the timestamp comes from. Time and Observed Time format the log's existing timestamp directly; Body and Attribute parse a timestamp string out of that field first.
Target Field Type	Enum	Yes	Attributes	Where the formatted timestamp is written: Attributes or Body.
Target Field	OTTL Field	Yes	(empty)	The field to write the formatted timestamp into.
Timestamp Format	String	Yes	%b %e %Y %H:%M:%S	The strptime format to write the timestamp in.

Source

The Source choice decides whether the processor parses anything:

• Time — format the log record's existing timestamp. No parsing.
• Observed Time — format the log's observed_time (when the collector saw it). No parsing.
• Body — parse a timestamp out of the body, then format it.
• Attribute — parse a timestamp out of an attribute, then format it.

Parsing the Source

These parameters appear only when Source is Body or Attribute, because only those paths parse a string.

Parameter	Type	Required	Default	Description
Source Field	OTTL Field	No	(empty)	The field holding the timestamp to parse. Leave empty with Body to rewrite a timestamp embedded in the whole body string (requires Extract Regex).
Input Format	String	No	(empty)	The strptime format the source timestamp is written in.
Extract Regex	String	No	(empty)	A regex with a named capture group to pull the timestamp out of the source. The first named group is used. Required to rewrite a timestamp embedded in the whole body.
Timezone	Timezone	No	(empty)	The timezone to interpret the source timestamp in, used only when the timestamp carries no zone of its own.
Locale	Locale	No	(empty)	The locale the source timestamp is written in, for non-English month and day names.

Condition

Parameter	Type	Required	Default	Description
Condition	OTTL Condition	No	(empty)	An OTTL condition that must be true for the processor to run. Empty applies it to every log.

Examples

Rewriting a timestamp embedded in the body, in place

The body 2024-10-11T22:14:15Z request completed becomes Oct 11 2024 22:14:15 request completed. With Body selected, an empty Source Field, and an Extract Regex, the processor extracts the matched timestamp, reparses it, reformats it, and splices the result back over the original substring, all in one step. This is the one-stop replacement for the old extract → parse → rewrite → concat pipeline.

Parsing an attribute and writing the result to another attribute

Reads raw_time, parses it with the given format, and writes a reformatted copy to display_time, leaving the original field intact.

Configuration Tips

Picking a Source

• Use Time or Observed Time when the record's timestamp is already correct and you just want a formatted string copy of it elsewhere. These never parse, so Input Format, Extract Regex, Timezone, and Locale don't apply.
• Use Body or Attribute when the timestamp you care about is text inside the log that needs to be parsed first.

Rewriting inside the body

• To rewrite a timestamp embedded in a raw body string, select Body, leave Source Field empty, and provide an Extract Regex with a named group. The regex both finds the substring to replace and identifies the value to reformat.

Timezone is a fallback

• Timezone is applied only when the source timestamp has no zone of its own. A value that already ends in Z or +02:00 keeps that zone.

Troubleshooting

The body or attribute is unchanged

Symptoms: The log passes through with its original timestamp text intact.

Solutions:

1. Confirm the Extract Regex matches the source and has a named capture group. A non-match is a safe no-op, so nothing is rewritten.
2. Check that Input Format matches the source value directive by directive. A format mismatch fails the parse and skips the rewrite.
3. For whole-body rewrites, confirm the body is a string and Source Field is empty.

The rewritten time is in the wrong zone

Symptoms: The timestamp reformats but the hour is off.

Solutions:

1. If the source timestamp has no zone, set Timezone to the zone the data was produced in.
2. If it already carries a zone, leave Timezone empty, it is ignored when a zone is present.

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: rewrite-body-timestamp
spec:
  type: rewrite_timestamp_v2
  parameters:
    - name: telemetry_types
      value: Logs
    - name: log_source_field_type
      value: Body
    - name: log_source_field
      value: ""
    - name: log_input_format
      value: '%Y-%m-%dT%H:%M:%SZ'
    - name: log_extract_regex
      value: '(?P<ts>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z)'
    - name: log_target_field_type
      value: Body
    - name: log_target_field
      value: ""
    - name: log_timestamp_format
      value: '%b %e %Y %H:%M:%S'

Migrating From the Previous Rewrite Timestamp

This processor replaces the earlier Rewrite Timestamp, which is now deprecated. The previous version only reformatted the record's existing timestamp, so reshaping a timestamp inside the body took a four-processor chain: Parse with Regex → Parse Timestamp → Rewrite Timestamp → Concat. This version collapses that into one processor via the Body / Attribute sources and the in-place body rewrite.

Mapping an existing config:

• The old timestamp-into-attribute behavior is the new Time source with a Target Field Type of Attributes, identical output.
• A chain that extracted, parsed, and reinserted a body timestamp becomes a single processor with Source Body, an Extract Regex, an Input Format, and Target Field Type Body.
• Metrics and Traces support was dropped. The previous version accepted them, but rewriting a timestamp into the telemetry itself is a logs concern; for metrics and traces, set the record timestamp with Parse Timestamp instead.

Related Resources

• OTTL FormatTime function
• OTTL Time function
• OTTL ExtractPatterns function
• OTTL replace_pattern function

Bindplane Resources

• ctime / strptime Layout Directives
• Parse Timestamp processor