Parse dates and timestamps with FilterX

To parse a date or a timestamp in FilterX, use the strptime function. It creates a datetime value from a string, using one or more format strings. It’s the FilterX equivalent of the date-parser() .

To use the parsed value as the timestamp of the message, pass it to the set_timestamp function.

For example, if the message contains key=value pairs like ts=2024-04-10T08:09:10+0200 user=alice, the following FilterX block parses the ts field, and sets it as the timestamp of the message:

filterx {
    fields = parse_kv(${MESSAGE}, value_separator="=", pair_separator=" ");
    ts = strptime(fields.ts, "%Y-%m-%dT%H:%M:%S%z", "%d/%b/%Y:%H:%M:%S%z");
    isset(ts);
    set_timestamp(ts);
};

• strptime tries the format strings in order. In this example, it accepts both 2024-04-10T08:09:10+0200 and 10/Apr/2024:08:09:10+0200. For the list of format codes, see strptime .
• If none of the formats match, strptime returns null. The isset statement then makes the FilterX block false, so AxoSyslog doesn’t send messages with an unparsable date.
• By default, set_timestamp sets the timestamp of the message (stamp). To set the time when AxoSyslog received the message instead, use set_timestamp(ts, stamp="recvd").

After the block, the date macros of the message, like ${ISODATE}, use the parsed timestamp.

If the timezone of your dates is missing or wrong, see Handle and fix timezones and timestamps.

To format a datetime value as a string, use the strftime or the format_isodate function.