Date and time functions let you convert, extract, and manipulate temporal values in SLS DSL transformation rules.
In SLS DSL transformation logic, all log values are stored as strings. You can convert data types as needed for your scenario.
Time in logs is represented by three main data types. Use the date and time functions described here to convert between these formats.
-
String
For example, 2022/07/03 02-41-26.
-
UNIX timestamp
For example, 1559500886.
-
Datetime object
For example, 2022-07-01 10:10:10+08:00 or 2022-07-01 10:10:10.
A UNIX timestamp is also a string.
Among the date and time functions described here, only dt_parse, dt_str, and dt_parsetimestamp accept all three data types as parameters. For all other functions, parameter types must be consistent.
Functions
|
Category |
Function |
Description |
|
Common datetime conversion |
Converts a value or a time expression's value to a datetime object. |
|
|
Converts a value or a time expression's value to a string. |
||
|
Converts a value or a time expression's value to a UNIX timestamp. |
||
|
Gets specific properties of a value or a time expression's value, such as day and year. |
||
|
Get datetime |
Gets the current datetime object. |
|
|
Gets the current date without the time. |
||
|
Gets the current datetime object in the current time zone. |
||
|
Converts a UNIX timestamp to a datetime object. |
||
|
Converts a UNIX timestamp to a datetime object in the current time zone. |
||
|
Parses a time string into a datetime object. |
||
|
Get UNIX timestamp |
Gets the current UNIX timestamp. |
|
|
Converts a datetime object to a UNIX timestamp. |
||
|
Get datetime string |
Converts a datetime object to a string in a specified format. |
|
|
Converts a UNIX timestamp to a string in a specified format. |
||
|
Modify datetime |
Truncates a value or a time expression's value to a specified time granularity. |
|
|
Modifies a value or a time expression's value based on a specified time granularity. |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
A value passed to the |
||
|
Modify time zone |
Converts a value or a time expression's value to a datetime object in a specific time zone. |
|
|
Get difference |
Gets the difference between two values or time expression values at a specific granularity. |
dt_parse
Converts a value or a time expression's value to a datetime object.
-
Syntax
dt_parse(value, tz=None) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the converted datetime object.
-
Examples
-
Example 1: Converts the value of the time field to a datetime object.
-
Raw log
time: 1559500886 -
Transformation rule
e_set("test_time", dt_parse(v("time"))) -
Result
time: 1559500886 test_time: 2019-06-02 18:41:26
-
-
Example 2: Converts the value of the time field to a datetime object in the Asia/Shanghai time zone.
-
Raw log
time: 2019-06-01 10:10:10 tz: Asia/Shanghai -
Transformation rule
e_set("test_time", dt_parse(v("time"),tz=v("tz"))) -
Result
time: 2019-06-01 10:10:10 tz: Asia/Shanghai test_time: 2019-06-01 10:10:10+08:00
-
-
dt_str
Converts a value or a time expression's value to a string.
-
Syntax
dt_str(value, fmt="format_string", tz=None) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
fmt
String
No
The format string. For more information, see Date and time format directives. If you leave this empty, the original format is used. The default value is empty.
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the converted time string.
-
Examples
-
Example 1: Converts the value of the time field to the specified format in the Asia/Tokyo time zone.
-
Raw log
time: 2019-06-03 02:41:26 fmt: %Y/%m/%d %H-%M-%S tz: Asia/Tokyo -
Transformation rule
e_set("dt_str", dt_str(v("time"),fmt=v("fmt"),tz=v("tz"))) -
Result
time: 2019-06-03 02:41:26 fmt: %Y/%m/%d %H-%M-%S tz: Asia/Tokyo dt_str: 2019/06/03 02-41-26
-
-
Example 2: Converts the value of the time field, which is a UNIX timestamp, to the specified format.
-
Raw log
time: 1559500886 fmt: %Y/%m/%d %H-%M-%S -
Transformation rule
e_set("dt_str", dt_str(v("time"),fmt=v("fmt"))) -
Result
time: 1559500886 fmt: %Y/%m/%d %H-%M-%S dt_str: 2019/06/02 18-41-26
-
-
Example 3: Converts the value of the time field to the default format.
-
Raw log
time: 2019-06-03 02:41:26 -
Transformation rule
e_set("dt_str", dt_str(v("time"))) -
Result
time: 2019-06-03 02:41:26 dt_str: 2019-06-03 02:41:26
-
-
dt_parsetimestamp
Converts a value or a time expression's value to a UNIX timestamp.
-
Syntax
dt_parsetimestamp(value, tz=None) -
Parameters
Parameter
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the converted UNIX timestamp.
-
Examples
-
Example 1: Converts the value of the time field to a timestamp in the Asia/Tokyo time zone.
-
Raw log
time: 2019-06-03 2:41:26 tz: Asia/Tokyo -
Transformation rule
e_set("dt_parsetimestamp", dt_parsetimestamp(v("time"),v("tz"))) -
Result
time: 2019-06-03 2:41:26 tz: Asia/Tokyo dt_parsetimestamp: 1559497286
-
-
Example 2: Converts the value of the time field to a UNIX timestamp.
-
Raw log
time: 2019-06-03 2:41:26 -
Transformation rule
e_set("dt_parsetimestamp",dt_parsetimestamp(v("time"))) -
Result
time: 2019-06-03 2:41:26 dt_parsetimestamp: 1559529686
-
-
Example 3: Converts the value of the time field to a UNIX timestamp.
-
Raw log
time: 2019-06-03 02:41:26+8:00 -
Transformation rule
e_set("dt_parsetimestamp",dt_parsetimestamp(v("time"))) -
Result
time: 2019-06-03 02:41:26+8:00 dt_parsetimestamp: 1559500886
-
-
dt_prop
Extracts a specific property from a value or a time expression's value, such as the day or year.
-
Syntax
dt_prop(value, props) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
props
String
Yes
The time property to get. For example, if you set this parameter to year, only the year is returned. Valid values include
day,year,month,hour,second,minute,microsecond,weekday,weekdayname,weekdayshortname,monthname,monthshortname,dayofyear,dayofweek,weekofyear,weekofyear_m,tzname, andweekofmonth. -
Response
Returns the extracted property.
-
Examples
-
Example 1: Extracts the day property from the value of the time field.
-
Raw log
time: 2018-10-2 09:11:40 -
Transformation rule
e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),"day")) -
Result
time: 2018-10-2 09:11:40 dt_parsetimestamp: 2
-
-
Example 2: Extracts the year property from the value of the time field.
-
Raw log
time: 2018-10-2 09:11:40 -
Transformation rule
e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),"year")) -
Result
time: 2018-10-2 09:11:40 dt_parsetimestamp: 2018
-
-
Example 3: Extracts the weekdayname property from the value of the time field.
-
Raw log
time: 2018-10-2 09:11:40 weekdayname: weekdayname -
Transformation rule
e_set("dt_prop",dt_prop(dt_parse(v("time")),"weekdayname")) -
Result
time: 2018-10-2 09:11:40 dt_prop: Tuesday
-
-
Example 4: Extracts the weekofyear property from the value of the time field.
-
Raw log
time: 2018-10-2 09:11:40 -
Transformation rule
e_set("dt_prop",dt_prop(dt_parse(v("time")),"weekofyear")) -
Result
time: 2018-10-2 09:11:40 dt_prop: 39
-
-
dt_now
Returns the current datetime object.
-
Syntax
dt_now(tz=None) -
Parameters
Parameter name
Parameter Type
Required
Description
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the datetime object for the specified time zone.
-
Examples
Returns the current time in the Asia/Shanghai time zone.
-
Raw log
tz: Asia/Shanghai -
Transformation rule
e_set("dt_now",dt_now(tz=v("tz"))) -
Result
tz: Asia/Shanghai dt_now: 2022-06-30 11:21:25.111836+08:00
-
dt_today
Returns the current date without the time component.
-
Syntax
dt_today(tz=None) -
Parameters
Parameter Name
Parameter type
Required
Description
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the date object for the specified time zone.
-
Examples
Returns the current date without the time component.
-
Raw log
None -
Transformation rule
e_set("dt_today", dt_today()) -
Result
dt_today: 2022-06-30 00:00:00
-
dt_utcnow
Returns the current datetime object in the current time zone.
-
Syntax
dt_utcnow() -
Parameters
None.
-
Response
Returns the current datetime object.
-
Examples
Returns the current time in the current time zone.
-
Raw log
None -
Transformation rule
e_set("dt_utcnow",dt_utcnow()) -
Result
dt_utcnow:2022-06-30 03:33:56.614005
-
dt_fromtimestamp
Converts a UNIX timestamp to a datetime object.
-
Syntax
dt_fromtimestamp(value, tz=None) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String
Yes
The value or time expression.
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
-
Response
Returns the converted datetime object.
-
Examples
-
Example 1: Converts the value of the time field to a datetime object.
-
Raw log
time: 1559500886 -
Transformation rule
e_set("dt_fromtimestamp",dt_fromtimestamp(v("time"))) -
Result
time: 1559500886 dt_fromtimestamp: 2019-06-02 18:41:26
-
-
Example 2: Converts the value of the time field to a datetime object in the Asia/Shanghai time zone.
-
Raw log
time: 1559500886 tz: Asia/Shanghai -
Transformation rule
e_set("dt_fromtimestamp",dt_fromtimestamp(v("time"),tz=v("tz"))) -
Result
time: 1559500886 tz: Asia/Shanghai dt_fromtimestamp: 2019-06-03 02:41:26+08:00
-
-
dt_utcfromtimestamp
Converts a UNIX timestamp to a datetime object in the current time zone.
-
Syntax
dt_utcfromtimestamp(value) -
Parameters
Parameter
Parameter type
Required
Description
value
String
Yes
The value or time expression.
-
Response
Returns the converted datetime object.
-
Examples
-
Raw log
time: 1559500886 -
Transformation rule
e_set("dt_utcfromtimestamp",dt_utcfromtimestamp(v("time"))) -
Result
time: 1559500886 dt_utcfromtimestamp: 2019-06-02 18:41:26
-
dt_strptime
Parses a time string into a datetime object.
-
Syntax
dt_strptime(value, "format_string") -
Parameters
Parameter Name
Parameter type
Required
Description
value
String
Yes
The value or time expression.
fmt
String
No
The format string. For more information, see Date and time format directives.
-
Response
Returns the parsed datetime object.
-
Examples
-
Raw log
time: 2019/06/03 02-41-26 fmt: %Y/%m/%d %H-%M-%S -
Transformation rule
e_set("dt_strptime",dt_strptime(v("time"),v("fmt"))) -
Result
time: 2019/06/03 02-41-26 fmt: %Y/%m/%d %H-%M-%S dt_strptime: 2019-06-03 02:41:26
-
dt_currentstamp
Returns the current UNIX timestamp.
-
Syntax
dt_currentstamp(value, normalize='floor') -
Parameters
Parameter Name
Parameter Type
Required
Description
value
String
Yes
The value or time expression.
normalize
String
No
The numeric format of the result. Valid values:
-
floor(default): Rounds the number down. -
int: Returns the integer part. -
round: Rounds the number. -
ceil: Rounds the number up.
-
-
Response
Returns the current UNIX timestamp.
-
Examples
-
Raw log
None -
Transformation rule
e_set("dt_currentstamp",dt_currentstamp()) -
Result
dt_currentstamp: 1656560437
-
dt_totimestamp
Converts a datetime object to a UNIX timestamp.
-
Syntax
dt_totimestamp(timeexpression) -
Parameters
Parameter Name
Parameter type
Required
Description
timeexpression
Datetime object
Yes
The datetime object to convert.
-
Response
Returns the converted UNIX timestamp.
-
Examples
-
Raw log
time: 2019-06-03 2:41:26 -
Transformation rule
e_set("dt_totimestamp",dt_totimestamp(dt_parse(v("time")))) -
Result
time: 2019-06-03 2:41:26 dt_totimestamp: 1559529686
-
dt_strftime
Converts a datetime object to a string in a specified format.
-
Syntax
dt_strftime(timeexpression, "format_string") -
Parameters
Parameter Name
Parameter type
Required
Description
timeexpression
Datetime object
Yes
The datetime object to convert.
format_string
String
Yes
The format string. For more information, see Date and time format directives.
-
Response
Returns the formatted string.
-
Examples
Converts the value of the time field to the specified format.
-
Raw log
time: 2019-06-03 2:41:26 fmt: %Y/%m/%d %H-%M-%S -
Transformation rule
e_set("dt_strftime",dt_strftime(dt_parse(v("time")),v("fmt"))) -
Result
time: 2019-06-03 2:41:26 fmt: %Y/%m/%d %H-%M-%S dt_strftime: 2019/06/03 02-41-26
-
dt_strftimestamp
Converts a UNIX timestamp to a string in a specified format.
-
Syntax
dt_strftimestamp(value, fmt="format_string", tz=None) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String
Yes
The UNIX timestamp to convert.
fmt
String
Yes
The format string. For more information, see Date and time format directives.
tz
String
No
The time zone. The default value is None, which uses UTC. For more information, see Time zones.
-
Response
Returns the formatted string.
-
Examples
-
Example 1
-
Raw log
time: 1559500886 fmt: %Y/%m/%d %H-%M-%S -
Transformation rule
e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt"))) -
Result
time: 1559500886 fmt: %Y/%m/%d %H-%M-%S dt_strftimestamp: 2019/06/02 18-41-26
-
-
Example 2
-
Raw log
time: 1559500886 fmt: %Y/%m/%d %H-%M-%S tz: Asia/Tokyo -
Transformation rule
e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt"),v("tz"))) -
Result
dt_strftimestamp:2019/06/03 03-41-26 fmt:%Y/%m/%d %H-%M-%S time:1559500886 tz:Asia/Tokyo
-
-
dt_truncate
Truncates a value or a time expression's value to a specified time granularity.
-
Syntax
dt_truncate(value, unit='day') -
Parameters
Parameter Name
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
unit
String
Yes
The time granularity to truncate to. The default value is day. Optional values include
second,minute,<num>_minute(for example, 5_minute, 19_minute, and 2_minute),hour,day,week,month,quarter,half_year, andyear. -
Response
Returns the truncated value at the specified time granularity.
-
Examples
-
Example 1
-
Raw log
time: 2019-06-03 2:41:26 unit: year -
Transformation rule
e_set("dt_truncate",dt_truncate(v("time"),v("unit"))) -
Result
time: 2019-06-03 2:41:26 unit: year dt_truncate: 2019-01-01 00:00:00
-
-
Example 2
-
Raw log
time: 2019-06-03 2:41:26 unit: hour -
Transformation rule
e_set("dt_truncate",dt_truncate(v("time"),v("unit"))) -
Result
time: 2019-06-03 2:41:26 unit: hour dt_truncate: 2019-06-03 02:00:00
-
-
dt_add
Modifies a value or a time expression's value based on a specified time granularity.
-
Syntax
dt_add(value, dt1=None, dt2=None, year(s)=None, month(s)=None, day(s)=None, hour(s)=None, minute(s)=None, second(s)=None, microsecond(s)=None, week(s)=None, weekday=None) -
Parameters
Parameter Name
Parameter type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The datetime expression.
dt1
String, UNIX timestamp, or datetime object
No
The datetime expression. The default value is None.
dt2
String, UNIX timestamp, or datetime object
No
The datetime expression. The default value is None.
year/years
Number
No
-
year: The year to replace the original year with. For example,
year=2020. The default value is None. -
years: The number of years to add. For example,
years=1adds one year to the original year.
day/days
Number
No
-
day: The day to replace the original day with. For example,
day=1. The default value is None. -
days: The number of days to add. For example,
days=1adds one day to the original day.
hour/hours
Number
No
-
hour: The hour to replace the original hour with. For example,
hour=1. The default value is None. -
hours: The number of hours to add. For example,
hours=1adds one hour to the original hour.
minute/minutes
Number
No
-
minute: The minute to replace the original minute with. For example,
minute=1. The default value is None. -
minutes: The number of minutes to add. For example,
minutes=1adds one minute to the original minute.
second/seconds
Number
No
-
second: The second to replace the original second with. For example,
second=1. The default value is None. -
seconds: The number of seconds to add. For example,
seconds=1adds one second to the original second.
microsecond/microseconds
Number
No
-
microsecond: Specifies the number of microseconds. For example,
microsecond=1. The default value is None. -
microseconds: The number of microseconds to add.
microseconds=1adds one microsecond to the original microsecond.
week/weeks
Number
No
-
week: The number of weeks to offset by. For example,
week=1. The default value is None. -
weeks: The number of weeks to add.
weeks=1adds one week to the original week.
weekday
Number
No
The weekday to offset to. For example,
weekday=dt_MO(1). The default value is None. -
-
Response
Returns the modified time expression.
-
Examples
-
Example 1
-
Raw log
dt: 2018-10-10 1:2:3 dt1: 2018-11-3 11:12:13 dt2: 2018-10-1 10:10:10 -
Transformation rule
e_set("dt_add",dt_add(dt_parse(v("dt")), dt1=dt_parse(v("dt1")), dt2=dt_parse(v("dt2")))) -
Result
dt:2018-10-10 1:2:3 dt1:2018-11-3 11:12:13 dt2:2018-10-1 10:10:10 dt_add:2018-11-12 02:04:06
-
-
Example 2
-
Raw log
dt: 2018-10-11 02:03:04 year: 2019 -
Transformation rule
e_set("dt_add", dt_add(dt_parse(v("dt")), year=ct_int(v("year")))) -
Result
dt:2018-10-11 02:03:04 dt_add:2019-10-11 02:03:04 year:2019
-
-
dt_MO
A value for the weekday parameter of the dt_add function that specifies an offset to a Monday.
-
Syntax
dt_MO(Integer_or_negative) -
Parameters
Parameter
Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
-
Raw log
time: 2019-08-13 02:03:04 -
Transformation rule
e_set("dt_MO",dt_add(v("time"),weekday=dt_MO(1))) -
Result
time: 2019-08-13 02:03:04 dt_MO: 2019-08-19 02:03:04
-
dt_TU
A value for the weekday parameter of the dt_add function that specifies an offset to a Tuesday.
-
Syntax
dt_TU(Integer_or_negative) -
Parameters
Parameter name
Parameter Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_WE
A value for the weekday parameter of the dt_add function that specifies an offset to a Wednesday.
-
Syntax
dt_WE(Integer_or_negative) -
Parameters
Parameter Name
Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_TH
A value for the weekday parameter of the dt_add function that specifies an offset to a Thursday.
-
Syntax
dt_TH(Integer_or_negative) -
Parameters
Parameter Name
Parameter Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_FR
A value for the weekday parameter of the dt_add function that specifies an offset to a Friday.
-
Syntax
dt_FR(Integer_or_negative) -
Parameters
Parameter Name
Parameter type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_SA
A value for the weekday parameter of the dt_add function that specifies an offset to a Saturday.
-
Syntax
dt_SA(Integer_or_negative) -
Parameters
Parameter Name
Parameter Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_SU
A value for the weekday parameter of the dt_add function that specifies an offset to a Sunday.
-
Syntax
dt_SU(Integer_or_negative) -
Parameters
Parameter name
Parameter Type
Required
Description
Integer_or_negative
Number
Yes
The offset value. To pass a negative number, use
op_neg(positive). For example, useop_neg(1)to represent -1. -
Response
Returns the offset time.
-
Examples
For an example, see dt_MO.
dt_astimezone
Converts a value or a time expression's value to a datetime object in a specific time zone.
-
Syntax
dt_astimezone(value, tz, reset=False) -
Parameters
Parameter
Type
Required
Description
value
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
tz
String
No
The time zone. The default value is None. For more information, see Time zones.
reset
Bool
No
Specifies whether to reset the time zone. The default value is False. If you set this to True, the function returns the original time but attaches the new time zone information without converting the time itself.
-
Response
Returns the datetime object in the specified time zone.
-
Examples
-
Example 1
-
Raw log
time: 2019-06-03 2:41:26 tz: UTC -
Transformation rule
e_set("dt_astimezone",dt_astimezone(dt_parse(v("time")), v("tz"))) -
Result
time: 2019-06-03 2:41:26 tz: UTC dt_astimezone: 2019-06-03 02:41:26+00:00
-
-
Example 2
-
Raw log
time: 2019-06-01 10:10:10+10:00 tz: Asia/Tokyo -
Transformation rule
e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=True)) -
Result
time: 2019-06-01 10:10:10+10:00 tz: Asia/Tokyo dt_astimezone: 2019-06-01 10:10:10+09:00
-
-
Example 3
-
Raw log
time: 2019-06-01 10:10:10+08:00 tz: Asia/Tokyo -
Transformation rule
e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=False)) e_set("dt_astimezone_true",dt_astimezone(v("time"), v("tz"),reset=True)) -
Result
dt_astimezone:2019-06-01 11:10:10+09:00 dt_astimezone_true:2019-06-01 10:10:10+09:00 time:2019-06-01 10:10:10+08:00 tz:Asia/Tokyo
-
-
dt_diff
Calculates the difference between two values or time expressions at a specified granularity.
-
Syntax
dt_diff(value1, value2, unit='second', normalize='floor') -
Parameters
Parameter name
Parameter type
Required
Description
value1
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
value2
String, UNIX timestamp, or datetime object
Yes
The value or time expression.
unit
String
No
The unit for the returned difference. The default value is
second. Other valid values includemicrosecond,millisecond,minutes,hours, andday.normalize
String
No
The numeric format of the result. Valid values:
-
floor(default): Rounds the number down. -
int: Returns the integer part. -
round: Rounds the number to N decimal places. -
ceil: Rounds the number up.
-
-
Response
Returns the difference between the two values at the specified granularity.
-
Examples
-
Example 1: Calculates the difference between the values of the time1 and time2 fields in seconds.
-
Raw log
time1: 2018-10-1 10:10:10 time2: 2018-10-1 10:10:10 -
Transformation rule
e_set("diff",dt_diff(v("time1"), v("time2"))) -
Result
time1: 2018-10-1 10:10:10 time2: 2018-10-1 10:10:10 diff: 0
-
-
Example 2: Calculates the difference between the values of the time1 and time2 fields in seconds.
-
Raw log
time1: 2018-10-1 11:10:10 time2: 2018-10-1 10:10:10 -
Transformation rule
e_set("diff",dt_diff(v("time1"), v("time2"))) -
Result
time1: 2018-10-1 11:10:10 time2: 2018-10-1 10:10:10 diff: 3600
-
-
Example 3: Calculates the difference between the values of the time1 and time2 fields in microseconds.
-
Raw log
time1: 2018-10-1 11:10:11 time2: 2018-10-1 10:10:10 unit: microsecond -
Transformation rule
e_set("diff",dt_diff(v("time1"), v("time2"),v("unit"))) -
Result
diff:3601000000 time1:2018-10-1 11:10:11 time2:2018-10-1 10:10:10 unit:microsecond
-
-
Example 4: Calculates the difference between the values of the time1 and time2 fields in minutes and rounds the result down.
-
Raw log
time1: 2018-10-1 11:11:59 time2: 2018-10-1 10:10:00 unit: minute normalize: floor -
Transformation rule
e_set("diff", dt_diff(v("time1"), v("time2"), v("unit"), v("normalize"))) -
Result
diff:61 normalize:floor time1:2018-10-1 11:11:59 time2:2018-10-1 10:10:00 unit:minute
-
-
Example 5: Calculates the difference between the values of the time1 and time2 fields in seconds and rounds the result down.
-
Raw log
time1: 10:00:00 time2: 11:00:00 unit: second normalize: floor -
Transformation rule
e_set("diff", dt_diff(v("time1"), v("time2"), v("unit"), v("normalize"))) -
Result
diff:-3600 normalize:floor time1:10:00:00 time2:11:00:00 unit:second
-
-