This topic describes the syntax of date and time functions and provides parameter description and function examples.

Date and time functions support the following data types: datetime object, string, and UNIX timestamp.
Note A UNIX timestamp is essentially a string.

In the transformation logic of LOG domain specific language (DSL), all values in log events are stored as strings. You need to convert the values to the required data types based on scenarios.

Among the date and time functions, only the dt_parse, dt_str, and dt_parsetimestamp functions support parameter values of all the three types. Other date and time functions require that the parameter values be of the specified type.

Functions

Type Function Description
Convert common datetime dt_parse Converts the value of a time expression to a datetime object.
dt_str Converts the value of a time expression to a string.
dt_parsetimestamp Converts the value of a time expression to a UNIX timestamp.
dt_prop Obtains the specific attribute of the value of a time expression.
Obtain the datetime dt_now Obtains the current datetime.
dt_today Obtains the current date excluding the time.
dt_utcnow Obtains the current datetime in the current time zone.
dt_fromtimestamp Converts a UNIX timestamp to a datetime object.
dt_utcfromtimestamp Converts a UNIX timestamp to a datetime object in the current time zone.
dt_strptime Parses a time string into a datetime object.
Obtain the UNIX timestamp dt_currentstamp Obtains a UNIX timestamp.
dt_totimestamp Converts a datetime object to a UNIX timestamp.
Obtain the datetime string dt_strftime Converts a datetime object to a string in the specified format.
dt_strftimestamp Converts a UNIX timestamp to a string in the specified format.
Modify the datetime dt_truncate Truncates the value of a time expression to the specified precision.
dt_add Modifies the value of a time expression based on the specified precision.
dt_MO Offsets the specified time to the date of the previous or next Nth Monday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_TU Offsets the specified time to the date of the previous or next Nth Tuesday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_WE Offsets the specified time to the date of the previous or next Nth Wednesday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_TH Offsets the specified time to the date of the previous or next Nth Thursday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_FR Offsets the specified time to the date of the previous or next Nth Friday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_SA Offsets the specified time to the date of the previous or next Nth Saturday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_SU Offsets the specified time to the date of the previous or next Nth Sunday. The offset value N is passed to the weekday parameter of the dt_add function, where N can be a positive or negative integer. To pass in a negative integer, use op_neg(positive integer).
Modify the time zone dt_astimezone Converts the value of a time expression to a datetime object in a specific time zone.
Obtain the time difference dt_diff Obtains the difference between values or between time expressions at the specified precision.

dt_parse

  • Syntax
    dt_parse(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The value to be converted.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The converted datetime object.

  • Examples
    • Example 1: Convert a timestamp to a datetime.
      Raw log:
      time: 1559500886
      Transformation rule:
      e_set("test_time", dt_parse(v("time")))
      Transformation result:
      time: 1559500886
      test_time: 2019-06-03 18:41:26 
    • Example 2: Convert a timestamp to a datetime in the time zone of Shanghai.
      Raw log:
      time: 2019-06-01 10:10:10
      tz: Asia/Shanghai
      Transformation rule:
      e_set("test_time", dt_parse(v("time"),tz=v("tz")))
      Transformation result:
      time: 2019-06-01 10:10:10
      tz: Asia/Shanghai
      test_time: 2019-06-01 10:10:10+08:00

dt_str

  • Syntax
    dt_str(value, fmt="format", tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    fmt String No The format. For more information, see Date and time formatting directives. If you do not set this parameter, the default format is used.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The converted time string.

  • Examples
    • Example 1: Convert a time to a specific format in the time zone of Tokyo.
      Raw log:
      time: 2019-06-03 02:41:26
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_str", dt_str(v("time"),fmt=v("fmt"),tz=v("tz")))
      Transformation result:
      time: 2019-06-03 02:41:26
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      dt_str: 2019/06/03 02-41-26
    • Example 2: Convert a timestamp to a specific format.
      Raw log:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      Transformation rule:
      e_set("dt_str", dt_str(v("time"),fmt=v("fmt")))
      Transformation result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      dt_str: 2019/06/03 02-41-26
    • Example 3: Convert a time to the default format.
      Raw log:
      time: 2019-06-03 02:41:26
      Transformation rule:
      e_set("dt_str", dt_str(v("time")))
      Transformation result:
      time: 2019-06-03 02:41:26
      dt_str: 2019-06-03 02:41:26

dt_parsetimestamp

  • Syntax
    dt_parsetimestamp(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The converted UNIX timestamp.

  • Examples
    • Example 1: Convert a time to a timestamp in the time zone of Tokyo.
      Raw log:
      time: 2019-06-03 2:41:26
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_parsetimestamp", dt_parsetimestamp(v("time"),v("tz")))
      Transformation result:
      time: 2019-06-03 2:41:26
      tz: Asia/Tokyo
      dt_parsetimestamp: 1559500886
    • Example 2: Convert a time to a timestamp.
      Raw log:
      time: 2019-06-03 2:41:26
      Transformation rule:
      e_set("dt_parsetimestamp",dt_parsetimestamp(v("time")))
      Transformation result:
      time: 2019-06-03 2:41:26
      dt_parsetimestamp: 1559529686
    • Example 3: Convert a time in UTC+8 to a timestamp.
      Raw log:
      time: 2019-06-03 02:41:26+8:00
      Transformation rule:
      e_set("dt_parsetimestamp",dt_parsetimestamp(v("time")))
      Transformation result:
      time: 2019-06-03 02:41:26+8:00
      dt_parsetimestamp: 1559500886

dt_prop

  • Syntax
    dt_prop(value, attribute)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    attribute String Yes The attribute to be obtained. For example, if the attribute is set to year, only the year is returned. Valid values: day, year, month, hour, second, minute, microsecond, weekday, weekdayname, weekdayshortname, monthname, monthshortname, dayofyear, dayofweek, weekofyear, weekofyear_m, tzname, and weekofmonth.
  • Response

    The extracted attribute.

  • Examples
    • Example 1: Extract the day attribute value of a time.
      Raw log:
      time: 2018-10-2 09:11:40
      day: day
      Transformation rule:
      e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),v("day")))
      Transformation result:
      time: 2018-10-2 09:11:40
      day: day
      dt_prop: 2
    • Example 2: Extract the year attribute value of a time.
      Raw log:
      time: 2018-10-2 09:11:40
      year: year
      Transformation rule:
      e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),v("year")))
      Transformation result:
      time: 2018-10-2 09:11:40
      year: year
      dt_prop: 2018
    • Example 3: Extract the weekdayname attribute value of a time.
      Raw log:
      time: 2018-10-2 09:11:40
      weekdayname: weekdayname
      Transformation rule:
      e_set("dt_prop",dt_prop(dt_parse(v("time")),v("weekdayname")))
      Transformation result:
      time: 2018-10-2 09:11:40
      weekdayname: weekdayname
      dt_prop: Tuesday
    • Example 4: Extract the weekofyear attribute value of a time.
      Raw log:
      time: 2018-10-2 09:11:40
      weekofyear: weekofyear
      Transformation rule:
      e_set("dt_prop",dt_prop(dt_parse(v("time")),v("weekofyear")))
      Transformation result:
      time: 2018-10-2 09:11:40
      weekofyear: weekofyear
      dt_prop: 39

dt_now

  • Syntax
    dt_now(tz=None)
  • Parameters
    Parameter Type Required Description
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The datetime object in the specified time zone.

  • Example: Obtain the current time in the time zone of Shanghai.
    Raw log:
    tz: Asia/Shanghai
    Transformation rule:
    e_set("dt_now",dt_now(tz=v("tz")))
    Transformation result:
    tz: Asia/Shanghai
    dt_now: 2019-06-10 11:24:00.655290

dt_today

  • Syntax
    dt_today(tz=None)
  • Parameters
    Parameter Type Required Description
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The date object in the specified time zone.

  • Example: Obtain the current date.
    Transformation rule:
    e_set("dt_today",dt_today())
    Transformation result:
    dt_today: 2019-06-10

dt_utcnow

  • Feature

    This function obtains the current datetime in the current time zone.

  • Syntax
    dt_utcnow()
  • Parameters

    None.

  • Response

    The current datetime in the current time zone.

  • Example: Obtain the current datetime in the current time zone.
    Transformation rule:
    e_set("dt_utcnow",dt_utcnow())
    Transformation result:
    dt_utcnow: 2019-06-10 03:32:51.510494

dt_fromtimestamp

  • Syntax
    dt_fromtimestamp(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String Yes The value or expression of the UNIX timestamp to be converted.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The converted datetime.

  • Examples
    • Example 1: Convert a timestamp to a datetime.
      Raw log:
      time: 1559500886
      Transformation rule:
      e_set("dt_fromtimestamp",dt_fromtimestamp(v("time")))
      Transformation result:
      time: 1559500886
      dt_fromtimestamp: 2019-06-03 02:41:26
    • Example 2: Convert a timestamp to a datetime in the time zone of Shanghai.
      Raw log:
      time: 1559500886
      tz: Asia/Shanghai
      Transformation rule:
      e_set("dt_fromtimestamp",dt_fromtimestamp(v("time"),tz=v("tz")))
      Transformation result:
      time: 1559500886
      tz: Asia/Shanghai
      dt_fromtimestamp: 2019-06-03 02:41:26+08:00

dt_utcfromtimestamp

  • Feature

    This function converts a UNIX timestamp to a datetime in the current time zone.

  • Syntax
    dt_utcfromtimestamp(value)
  • Parameters
    Parameter Type Required Description
    value String Yes The value or expression of the UNIX timestamp to be converted.
  • Response

    The converted datetime object.

  • Examples
    Raw log:
    time: 1559500886
    Transformation rule:
    e_set("dt_utcfromtimestamp",dt_utcfromtimestamp(v("time")))
    Transformation result:
    time: 1559500886
    dt_utcfromtimestamp: 2019-06-02 18:41:26

dt_strptime

  • Syntax
    dt_strptime(value, "format")
  • Parameters
    Parameter Type Required Description
    value String Yes The string to be parsed.
    fmt String No The format. For more information, see Date and time formatting directives.
  • Response

    The parsed datetime object.

  • Examples
    Raw log:
    time: 2019/06/03 02-41-26
    fmt: %Y/%m/%d %H-%M-%S
    Transformation rule:
    e_set("dt_strptime",dt_strptime(v("time",v("fmt"))))
    Transformation result:
    time: 2019/06/03 02-41-26
    fmt: %Y/%m/%d %H-%M-%S
    dt_strptime: 2019-06-03 02:41:26

dt_currentstamp

  • Feature

    This function obtains the current UNIX timestamp.

  • Syntax
    dt_currentstamp(value, normalize='floor')
  • Parameters
    Parameter Type Required Description
    value String Yes The string to be parsed.
    normalize String No The numeric format of the computing result. Valid values:
    • floor (default): rounds a number down to the nearest integer.
    • int: removes the decimal part of a number.
    • round: rounds a number to the nearest integer.
    • ceil: rounds a number up to the nearest integer.
  • Response

    The current UNIX timestamp.

  • Examples
    Transformation rule:
    e_set("dt_currentstamp",dt_currentstamp())
    Transformation result:
    dt_currentstamp: 1559500886

dt_totimestamp

  • Feature

    This function converts a datetime object to a UNIX timestamp.

  • Syntax
    dt_totimestamp(datetime expression)
  • Parameters
    Parameter Type Required Description
    datetime expression Datetime object Yes The datetime object to be converted.
  • Response

    The converted UNIX timestamp.

  • Examples
    Raw log:
    time: 2019-06-03 2:41:26
    Transformation rule:
    e_set("dt_totimestamp",dt_totimestamp(dt_parse(v("time"))))
    Transformation result:
    time: 2019-06-03 2:41:26
    dt_totimestamp: 1559500886

dt_strftime

  • Syntax
    dt_strftime(datetime expression, "format")
  • Parameters
    Parameter Type Required Description
    datetime expression Datetime object Yes The datetime object to be converted.
    format String Yes The format. For more information, see Date and time formatting directives.
  • Response

    The formatted string.

  • Example: Convert a time to a specific format.
    Raw log:
    time: 2019-06-03 2:41:26
    fmt: %Y/%m/%d %H-%M-%S
    Transformation rule:
    e_set("dt_strftime",dt_strftime(dt_parse(v("time")),v("fmt")))
    Transformation result:
    time: 2019-06-03 2:41:26
    fmt: %Y/%m/%d %H-%M-%S
    dt_strftime: 2019/06/03 02-41-26

dt_strftimestamp

  • Syntax
    dt_strftimestamp(value, fmt="format", tz=None)
  • Parameters
    Parameter Type Required Description
    value String Yes The UNIX timestamp to be converted.
    fmt String Yes The format. For more information, see Date and time formatting directives.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Response

    The formatted string.

  • Examples
    • Example 1
      Raw log:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      Transformation rule:
      e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt")))
      Transformation result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      dt_strftimestamp: 2019/06/03 02-41-26
    • Example 2
      Raw log:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt"),v("tz")))
      Transformation result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      dt_strftimestamp: 2019/06/03 03-41-26 +0900

dt_truncate

  • Syntax
    dt_truncate(value, unit='day')
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    unit String Yes The precision of the time attribute to be obtained. Default value: day. Valid values: second, minute, <num>_minute (for example, 5_minute, 19_minute, and 2_minute), hour, day, week, month, quarter, half_year, and year.
  • Response

    The time truncated to the specified precision.

  • Examples
    • Example 1
      Raw log:
      time: 2019-06-03 2:41:26
      unit: year
      Transformation rule:
      e_set("dt_truncate",dt_truncate(v("time"),v("unit")))
      Transformation result:
      time: 2019-06-03 2:41:26
      unit: year
      dt_truncate: 2019-01-01 00:00:00
    • Example 2
      Raw log:
      time: 2019-06-03 2:41:26
      unit: hour
      Transformation rule:
      e_set("dt_truncate",dt_truncate(v("time"),v("unit")))
      Transformation result:
      time: 2019-06-03 2:41:26
      unit: hour
      dt_truncate: 2019-06-03 02:00:00

dt_add

  • Syntax
    dt_add(value, dt1=None, dt2=None, year(s)=None, month(s)=None, day(s)=None, hour(s)=None, minute(s)=None, second(s)=None, microsecond(s)=None, week(s)=None, weekday=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The datetime expression.
    dt1 String, UNIX timestamp, or datetime object No The datetime expression. Default value: None.
    dt2 String, UNIX timestamp, or datetime object No The datetime expression. Default value: None.
    year or years Number No
    • year: the year used to replace the year in the specified time. For example, set year=2020. Default value: None.
    • years: the number of years by which you want to offset the specified time. For example, years=1 increases the year by 1.
    day or days Number No
    • day: the day used to replace the day in the specified time. For example, set day=1. Default value: None.
    • days: the number of days by which you want to offset the specified time. For example, days=1 increases the day by 1.
    hour or hours Number No
    • hour: the hour used to replace the hour in the specified time. For example, set hour=1. Default value: None.
    • hours: the number of hours by which you want to offset the specified time. For example, hours=1 increases the hour by 1.
    minute or minutes Number No
    • minute: the minute used to replace the minute in the specified time. For example, set minute=1. Default value: None.
    • minutes: the number of minutes by which you want to offset the specified time. For example, minutes=1 increases the minute by 1.
    second or seconds Number No
    • second: the second used to replace the second in the specified time. For example, set second=1. Default value: None.
    • seconds: the number of seconds by which you want to offset the specified time. For example, seconds=1 increases the second by 1.
    microsecond or microseconds Number No
    • microsecond: the microsecond used to replace the microsecond in the specified time. For example, set microsecond=1. Default value: None.
    • microseconds: the number of microseconds by which you want to offset the specified time. For example, microseconds=1 increases the microsecond by 1.
    week or weeks Number No
    • week: the number of weeks by which you want to offset the specified time. For example, set week=1. Default value: None.
    • weeks: the number of weeks by which you want to offset the specified time. For example, weeks=1 increases the week by 1.
    weekday Number No The weekday relative to which you want to offset the specified time. For example, set weekday=dt_MO(1). Default value: None.
  • Response

    The modified time expression.

  • Examples
    • Example 1
      Raw log:
      dt: 2018-10-10 1:2:3
      dt1: 2018-11-3 11:12:13
      dt2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("dt_add",dt_add(dt_parse(v("dt")), dt1=dt_parse(v("dt1")), dt2=dt_parse(v("dt2"))))
      Transformation result:
      dt: 2018-10-10 1:2:3
      dt1: 2018-11-3 11:12:13
      dt2: 2018-10-1 10:10:10
      dt_add: 2018-11-12 02:04:06
    • Example 2
      Raw log:
      dt: 2018-10-11 02:03:04
      year: 2019
      Transformation rule:
      e_set("dt_add",dt_add(dt_parse(v("dt")),v("year")))
      Transformation result:
      dt: 2018-10-11 02:03:04
      year: 2019
      dt_add: 2019-10-11 02:03:04

dt_MO

  • Syntax
    dt_MO(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples
    Raw log:
    time: 2019-08-13 02:03:04
    Transformation rule:
    e_set("dt_MO",dt_add(v("time"),weekday=dt_MO(1)))
    Transformation result:
    time: 2019-08-13 02:03:04
    dt_MO: 2019-08-19 02:03:04

dt_TU

  • Syntax
    dt_TU(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_WE

  • Syntax
    dt_WE(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_TH

  • Syntax
    dt_TH(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_FR

  • Syntax
    dt_FR(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_SA

  • Syntax
    dt_SA(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_SU

  • Syntax
    dt_SU(positive or negative integer)
  • Parameters
    Parameter Type Required Description
    positive or negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Response

    The time with the offset.

  • Examples

    For more information, see the examples of the dt_MO function.

dt_astimezone

  • Syntax
    dt_astimezone(value, tz=None, reset=False)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression to be modified.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
    reset Boolean No Specifies whether to reset the time zone. Default value: False, indicating that the time zone is not reset. A value of True indicates that the time in the specified time zone is returned.
  • Response

    The datetime object in the specified time zone.

  • Examples
    • Example 1
      Raw log:
      time: 2019-06-03 2:41:26
      tz: UTC
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(dt_parse(v("time")), v("tz")))
      Transformation result:
      time: 2019-06-03 2:41:26
      tz: UTC
      dt_astimezone: 2019-06-03 02:41:26+00:00
    • Example 2
      Raw log:
      time: 2019-06-01 10:10:10+10:00
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=True))
      Transformation result:
      time: 2019-06-01 10:10:10+10:00
      tz: Asia/Tokyo
      dt_astimezone: 2019-06-01 10:10:10+09:00
    • Example 3
      Raw log:
      time: 2019-06-01 10:10:10+08:00
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=False))
      e_set("dt_astimezone_true",dt_astimezone(v("time"), v("tz"),reset=True))
      Transformation result:
      time: 2019-06-01 10:10:10+08:00
      tz: Asia/Tokyo
      dt_astimezone: 2019-06-01 11:10:10+09:00
      dt_astimezone_true: 2019-06-01 10:10:10+09:00

dt_diff

  • Syntax
    dt_diff(value 1, value 2, unit='second', normalize='floor')
  • Parameters
    Parameter Type Required Description
    value 1 String, UNIX timestamp, or datetime object Yes The time expression 1 to be compared.
    value 2 String, UNIX timestamp, or datetime object Yes The time expression 2 to be compared.
    unit String No The precision used to express the time difference. Default value: second. Valid values also include microsecond, millisecond, minutes, hours, and day.
    normalize String No The numeric format of the computing result. Valid values:
    • floor (default): rounds a number down to the nearest integer.
    • int: removes the decimal part of a number.
    • round: rounds a number to the nearest integer.
    • ceil: rounds a number up to the nearest integer.
  • Response

    The difference between two values obtained at the specified precision.

  • Examples
    • Example 1
      Raw log:
      time1: 2018-10-1 10:10:10
      time2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2")))
      Transformation result:
      time1: 2018-10-1 10:10:10
      time2: 2018-10-1 10:10:10
      diff: 0
    • Example 2
      Raw log:
      time1: 2018-10-1 11:10:10
      time2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2")))
      Transformation result:
      time1: 2018-10-1 11:10:10
      time2: 2018-10-1 10:10:10
      diff: 3600
    • Example 3
      Raw log:
      time1: 2018-10-1 11:10:11
      time2: 2018-10-1 10:10:10
      unit: microsecond
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2"),v("unit")))
      Transformation result:
      time1: 2018-10-1 11:10:11
      time2: 2018-10-1 10:10:10
      unit: microsecond
      diff: 1000000
    • Example 4
      Raw log:
      time1: 2018-10-1 11:11:59
      time2: 2018-10-1 10:10:00
      unit: minute
      normalize: floor
      Transformation rule:
      dt_diff(v("time1"), v("time2"),v("unit"),v("normalize"))
      Transformation result:
      time1: 2018-10-1 11:11:59
      time2: 2018-10-1 10:10:00
      unit: minute
      normalize: floor
      diff: 61
    • Example 5: Compute the difference between two time values without the dates involved.
      Raw log:
      time1: 10:00:00
      time2: 11:00:00
      unit: second
      normalize: floor
      Transformation rule:
      dt_diff(v("time1"), v("time2"),v("unit"),v("normalize"))
      Transformation result:
      time1: 10:00:00
      time2: 11:00:00
      unit: second
      normalize: floor
      diff: 3600