This topic describes the syntax and parameters of date and time functions. This topic also provides examples on how to use data and time functions.

Date and time functions support the following data types: datetime object, string, and UNIX timestamp.
Note A UNIX timestamp is a string.

All values in log events are stored as strings based on the transformation logic of Log Service domain-specific language (DSL). You must convert data types based on your business requirements.

Among the date and time functions that are described in this topic, only the dt_parse, dt_str, and dt_parsetimestamp functions support parameter values of all the three types. For each of other date and time functions, you must make sure that the parameter values are of the same type.

Functions

Scenario Function Description
Convert common datetime dt_parse Converts the value of a time expression to a datetime object.
dt_str Converts the value of a time expression to a string.
dt_parsetimestamp Converts the value of a time expression to a UNIX timestamp.
dt_prop Obtains a specific attribute from the value of a time expression.
Obtains datetime dt_now Obtains the current datetime.
dt_today Obtains the current date without time.
dt_utcnow Obtains the current datetime in the current time zone.
dt_fromtimestamp Converts a UNIX timestamp to a datetime object.
dt_utcfromtimestamp Converts a UNIX timestamp to a datetime object in the current time zone.
dt_strptime Parses a time string into a datetime object.
Obtains a UNIX timestamp dt_currentstamp Obtains a UNIX timestamp.
dt_totimestamp Converts a datetime object to a UNIX timestamp.
Obtains a datetime string dt_strftime Converts a datetime object to a string in the specified format.
dt_strftimestamp Converts a UNIX timestamp to a string in the specified format.
Modify datetime dt_truncate Truncates the value of a time expression based on the specified precision.
dt_add Modifies the value of a time expression based on the specified precision.
dt_MO Offsets the specified time to the date of the previous or next Nth Monday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_TU Offsets the specified time to the date of the previous or next Nth Tuesday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_WE Offsets the specified time to the date of the previous or next Nth Wednesday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_TH Offsets the specified time to the date of the previous or next Nth Thursday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_FR Offsets the specified time to the date of the previous or next Nth Friday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_SA Offsets the specified time to the date of the previous or next Nth Saturday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
dt_SU Offsets the specified time to the date of the previous or next Nth Sunday. The offset value N is passed to the weekday parameter of the dt_add function. N can be a positive integer or a negative integer. To pass in a negative integer, use op_neg(positive integer).
Modify a time zone dt_astimezone Converts the value of a time expression to a datetime object in the specified time zone.
Obtains the time difference dt_diff Obtains the difference between values or between the values of time expressions based on the specified precision.

dt_parse

  • Syntax
    dt_parse(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The value that you want to convert.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The converted datetime object.

  • Examples
    • Example 1: Convert a timestamp to a datetime object.
      Raw log entry:
      time: 1559500886
      Transformation rule:
      e_set("test_time", dt_parse(v("time")))
      Result:
      time: 1559500886
      test_time: 2019-06-03 18:41:26 
    • Example 2: Convert a timestamp to a datetime object in the time zone of Shanghai.
      Raw log entry:
      time: 2019-06-01 10:10:10
      tz: Asia/Shanghai
      Transformation rule:
      e_set("test_time", dt_parse(v("time"),tz=v("tz")))
      Result:
      time: 2019-06-01 10:10:10
      tz: Asia/Shanghai
      test_time: 2019-06-01 10:10:10+08:00

dt_str

  • Syntax
    dt_str(value, fmt="format", tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    fmt String No The format. For more information, see Date and time formatting directives. If you do not set this parameter, the default format is used.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The converted time string.

  • Examples
    • Example 1: Convert a point in time to a time string in the specified format in the time zone of Tokyo.
      Raw log entry:
      time: 2019-06-03 02:41:26
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_str", dt_str(v("time"),fmt=v("fmt"),tz=v("tz")))
      Result:
      time: 2019-06-03 02:41:26
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      dt_str: 2019/06/03 02-41-26
    • Example 2: Convert a timestamp to a time string in the specified format.
      Raw log entry:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      Transformation rule:
      e_set("dt_str", dt_str(v("time"),fmt=v("fmt")))
      Result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      dt_str: 2019/06/03 02-41-26
    • Example 3: Convert a point in time to a time string in the default format.
      Raw log entry:
      time: 2019-06-03 02:41:26
      Transformation rule:
      e_set("dt_str", dt_str(v("time")))
      Result:
      time: 2019-06-03 02:41:26
      dt_str: 2019-06-03 02:41:26

dt_parsetimestamp

  • Syntax
    dt_parsetimestamp(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The converted UNIX timestamp.

  • Examples
    • Example 1: Convert a point in time to a timestamp in the time zone of Tokyo.
      Raw log entry:
      time: 2019-06-03 2:41:26
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_parsetimestamp", dt_parsetimestamp(v("time"),v("tz")))
      Result:
      time: 2019-06-03 2:41:26
      tz: Asia/Tokyo
      dt_parsetimestamp: 1559500886
    • Example 2: Convert a point in time to a timestamp.
      Raw log entry:
      time: 2019-06-03 2:41:26
      Transformation rule:
      e_set("dt_parsetimestamp",dt_parsetimestamp(v("time")))
      Result:
      time: 2019-06-03 2:41:26
      dt_parsetimestamp: 1559529686
    • Example 3: Convert a point in time in UTC+8 to a timestamp.
      Raw log entry:
      time: 2019-06-03 02:41:26+8:00
      Transformation rule:
      e_set("dt_parsetimestamp",dt_parsetimestamp(v("time")))
      Result:
      time: 2019-06-03 02:41:26+8:00
      dt_parsetimestamp: 1559500886

dt_prop

  • Syntax
    dt_prop(value, attribute)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    attribute String Yes The attribute whose value you want to obtain. For example, if the attribute parameter is set to year, only the year is returned. Valid values: day, year, month, hour, second, minute, microsecond, weekday, weekdayname, weekdayshortname, monthname, monthshortname, dayofyear, dayofweek, weekofyear, weekofyear_m, tzname, and weekofmonth.
  • Returned result

    The extracted attribute value.

  • Examples
    • Example 1: Extract the value of the day attribute from a time string.
      Raw log entry:
      time: 2018-10-2 09:11:40
      day: day
      Transformation rule:
      e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),v("day")))
      Result:
      time: 2018-10-2 09:11:40
      day: day
      dt_prop: 2
    • Example 2: Extract the value of the year attribute from a time string.
      Raw log entry:
      time: 2018-10-2 09:11:40
      year: year
      Transformation rule:
      e_set("dt_parsetimestamp",dt_prop(dt_parse(v("time")),v("year")))
      Result:
      time: 2018-10-2 09:11:40
      year: year
      dt_prop: 2018
    • Example 3: Extract the value of the weekdayname attribute from a time string.
      Raw log entry:
      time: 2018-10-2 09:11:40
      weekdayname: weekdayname
      Transformation rule:
      e_set("dt_prop",dt_prop(dt_parse(v("time")),v("weekdayname")))
      Result:
      time: 2018-10-2 09:11:40
      weekdayname: weekdayname
      dt_prop: Monday
    • Example 4: Extract the value of the weekofyear attribute from a time string.
      Raw log entry:
      time: 2018-10-2 09:11:40
      weekofyear: weekofyear
      Transformation rule:
      e_set("dt_prop",dt_prop(dt_parse(v("time")),v("weekofyear")))
      Result:
      time: 2018-10-2 09:11:40
      weekofyear: weekofyear
      dt_prop: 22

dt_now

  • Syntax
    dt_now(tz=None)
  • Parameters
    Parameter Type Required Description
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The datetime object in the specified time zone.

  • Example: Obtain the current time in the time zone of Shanghai.
    Raw log entry:
    tz: Asia/Shanghai
    Transformation rule:
    e_set("dt_now",dt_now(tz=v("tz")))
    Result:
    tz: Asia/Shanghai
    dt_now: 2019-06-10 11:24:00.655290

dt_today

  • Syntax
    dt_today(tz=None)
  • Parameters
    Parameter Type Required Description
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The date object in the specified time zone.

  • Example: Obtain the current date.
    Transformation rule:
    e_set("dt_today",dt_today())
    Result:
    dt_today: 2019-06-10

dt_utcnow

  • Feature

    This function is used to obtain the current datetime in the current time zone.

  • Syntax
    dt_utcnow()
  • Parameters

    None.

  • Returned result

    The current datetime in the current time zone.

  • Example: Obtain the current datetime in the current time zone.
    Transformation rule:
    e_set("dt_utcnow",dt_utcnow())
    Result:
    dt_utcnow: 2019-06-10 03:32:51.510494

dt_fromtimestamp

  • Syntax
    dt_fromtimestamp(value, tz=None)
  • Parameters
    Parameter Type Required Description
    value String Yes The value or expression of the UNIX timestamp that you want to convert.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The converted datetime.

  • Examples
    • Example 1: Convert a timestamp to a datetime.
      Raw log entry:
      time: 1559500886
      Transformation rule:
      e_set("dt_fromtimestamp",dt_fromtimestamp(v("time")))
      Result:
      time: 1559500886
      dt_fromtimestamp: 2019-06-03 02:41:26
    • Example 2: Convert a timestamp to a datetime in the time zone of Shanghai.
      Raw log entry:
      time: 1559500886
      tz: Asia/Shanghai
      Transformation rule:
      e_set("dt_fromtimestamp",dt_fromtimestamp(v("time"),tz=v("tz")))
      Result:
      time: 1559500886
      tz: Asia/Shanghai
      dt_fromtimestamp: 2019-06-03 02:41:26+08:00

dt_utcfromtimestamp

  • Feature

    This function is used to convert a UNIX timestamp to datetime in the current time zone.

  • Syntax
    dt_utcfromtimestamp(value)
  • Parameters
    Parameter Type Required Description
    value String Yes The value or expression of the UNIX timestamp that you want to convert.
  • Returned result

    The converted datetime object.

  • Example
    Raw log entry:
    time: 1559500886
    Transformation rule:
    e_set("dt_utcfromtimestamp",dt_utcfromtimestamp(v("time")))
    Result:
    time: 1559500886
    dt_utcfromtimestamp: 2019-06-02 18:41:26

dt_strptime

  • Syntax
    dt_strptime(value, "format")
  • Parameters
    Parameter Type Required Description
    value String Yes The string that you want to parse.
    fmt String No The format. For more information, see Date and time formatting directives.
  • Returned result

    The datetime object that is parsed.

  • Example
    Raw log entry:
    time: 2019/06/03 02-41-26
    fmt: %Y/%m/%d %H-%M-%S
    Transformation rule:
    e_set("dt_strptime",dt_strptime(v("time"),v("fmt")))
    Result:
    time: 2019/06/03 02-41-26
    fmt: %Y/%m/%d %H-%M-%S
    dt_strptime: 2019-06-03 02:41:26

dt_currentstamp

  • Feature

    This function is used to obtain the current UNIX timestamp.

  • Syntax
    dt_currentstamp(value, normalize='floor')
  • Parameters
    Parameter Type Required Description
    value String Yes The string that you want to parse.
    normalize String No The numeric format in which you want the function to return the result. Valid values:
    • floor: rounds a number down to the nearest integer. Default value: floor.
    • int: removes the decimal part of a number.
    • round: rounds a number to the nearest integer.
    • ceil: rounds a number up to the nearest integer.
  • Returned result

    The current UNIX timestamp.

  • Example
    Transformation rule:
    e_set("dt_currentstamp",dt_currentstamp())
    Result:
    dt_currentstamp: 1559500886

dt_totimestamp

  • Feature

    This function is used to convert a datetime object to a UNIX timestamp.

  • Syntax
    dt_totimestamp(datetime expression)
  • Parameters
    Parameter Type Required Description
    Datetime expression Datetime object Yes The datetime object that you want to convert.
  • Returned result

    The converted UNIX timestamp.

  • Example
    Raw log entry:
    time: 2019-06-03 2:41:26
    Transformation rule:
    e_set("dt_totimestamp",dt_totimestamp(dt_parse(v("time"))))
    Result:
    time: 2019-06-03 2:41:26
    dt_totimestamp: 1559500886

dt_strftime

  • Syntax
    dt_strftime(datetime expression, "format")
  • Parameters
    Parameter Type Required Description
    Datetime expression Datetime object Yes The datetime object that you want to convert.
    format String Yes The format. For more information, see Date and time formatting directives.
  • Returned result

    The formatted string.

  • Example: Convert a time to a string in the specified format.
    Raw log entry:
    time: 2019-06-03 2:41:26
    fmt: %Y/%m/%d %H-%M-%S
    Transformation rule:
    e_set("dt_strftime",dt_strftime(dt_parse(v("time")),v("fmt")))
    Result:
    time: 2019-06-03 2:41:26
    fmt: %Y/%m/%d %H-%M-%S
    dt_strftime: 2019/06/03 02-41-26

dt_strftimestamp

  • Syntax
    dt_strftimestamp(value, fmt="format", tz=None)
  • Parameters
    Parameter Type Required Description
    value String Yes The UNIX timestamp that you want to convert.
    fmt String Yes The format. For more information, see Date and time formatting directives.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
  • Returned result

    The formatted string.

  • Examples
    • Example 1
      Raw log entry:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      Transformation rule:
      e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt")))
      Result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      dt_strftimestamp: 2019/06/03 02-41-26
    • Example 2
      Raw log entry:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_strftimestamp",dt_strftimestamp(v("time"),v("fmt"),v("tz")))
      Result:
      time: 1559500886
      fmt: %Y/%m/%d %H-%M-%S
      tz: Asia/Tokyo
      dt_strftimestamp: 2019/06/03 03-41-26 +0900

dt_truncate

  • Syntax
    dt_truncate(value, unit='day')
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression.
    unit String Yes The precision of the time attribute that you want to obtain. Default value: day. Valid values: second, minute, <num>_minute (for example, 5_minute, 19_minute, and 2_minute), hour, day, week, month, quarter, half_year, and year.
  • Returned result

    The time that is in the specified precision.

  • Examples
    • Example 1
      Raw log entry:
      time: 2019-06-03 2:41:26
      unit: year
      Transformation rule:
      e_set("dt_truncate",dt_truncate(v("time"),v("unit")))
      Result:
      time: 2019-06-03 2:41:26
      unit: year
      dt_truncate: 2019-01-01 00:00:00
    • Example 2
      Raw log entry:
      time: 2019-06-03 2:41:26
      unit: hour
      Transformation rule:
      e_set("dt_truncate",dt_truncate(v("time"),v("unit")))
      Result:
      time: 2019-06-03 2:41:26
      unit: hour
      dt_truncate: 2019-06-03 02:00:00

dt_add

  • Syntax
    dt_add(value, dt1=None, dt2=None, year(s)=None, month(s)=None, day(s)=None, hour(s)=None, minute(s)=None, second(s)=None, microsecond(s)=None, week(s)=None, weekday=None)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The datetime expression.
    dt1 String, UNIX timestamp, or datetime object No The datetime expression. Default value: None.
    dt2 String, UNIX timestamp, or datetime object No The datetime expression. Default value: None.
    year/years Number No
    • year: the year that is used to replace the year in the specified time. For example, you can set year=2020. Default value: None.
    • years: the number of years by which you want to offset the specified time. For example, if you set years=1, the function increases the year by 1.
    day/days Number No
    • day: the day that is used to replace the day in the specified time. For example, you can set day=1. Default value: None.
    • days: the number of days by which you want to offset the specified time. For example, if you set days=1, the function increases the day by 1.
    hour/hours Number No
    • hour: the hour that is used to replace the hour in the specified time. For example, you can set hour=1. Default value: None.
    • hours: the number of hours by which you want to offset the specified time. For example, if you set hours=1, the function increases the hour by 1.
    minute/minutes Number No
    • minute: the minute that is used to replace the minute in the specified time. For example, you can set minute=1. Default value: None.
    • minutes: the number of minutes by which you want to offset the specified time. For example, if you set minutes=1, the function increases the minute by 1.
    second/seconds Number No
    • second: the second that is used to replace the second in the specified time. For example, you can set second=1. Default value: None.
    • seconds: the number of seconds by which you want to offset the specified time. For example, if you set seconds=1, the function increases the second by 1.
    microsecond/microseconds Number No
    • microsecond: the microsecond that is used to replace the microsecond in the specified time. For example, you can set microsecond=1. Default value: None.
    • microseconds: the number of microseconds by which you want to offset the specified time. For example, if you set microseconds=1, the function increases the microsecond by 1.
    week/weeks Number No
    • week: the week that is used to replace the week in the specified time. For example, you can set week=1. Default value: None.
    • weeks: the number of weeks by which you want to offset the specified time. For example, if you set weeks=1, the function increases the week by 1.
    weekday Number No The weekday that is used to replace the weekday in the specified time. For example, you can set weekday=dt_MO(1). Default value: None.
  • Returned result

    The time expression that is modified.

  • Examples
    • Example 1
      Raw log entry:
      dt: 2018-10-10 1:2:3
      dt1: 2018-11-3 11:12:13
      dt2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("dt_add",dt_add(dt_parse(v("dt")), dt1=dt_parse(v("dt1")), dt2=dt_parse(v("dt2"))))
      Result:
      dt: 2018-10-10 1:2:3
      dt1: 2018-11-3 11:12:13
      dt2: 2018-10-1 10:10:10
      dt_add: 2018-11-12 02:04:06
    • Example 2
      Raw log entry:
      dt: 2018-10-11 02:03:04
      year: 2019
      Transformation rule:
      e_set("dt_add",dt_add(dt_parse(v("dt")),v("year")))
      Result:
      dt: 2018-10-11 02:03:04
      year: 2019
      dt_add: 2019-10-11 02:03:04

dt_MO

  • Syntax
    dt_MO(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Example
    Raw log entry:
    time: 2019-08-13 02:03:04
    Transformation rule:
    e_set("dt_MO",dt_add(v("time"),weekday=dt_MO(1)))
    Result:
    time: 2019-08-13 02:03:04
    dt_MO: 2019-08-19 02:03:04

dt_TU

  • Syntax
    dt_TU(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_WE

  • Syntax
    dt_WE(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_TH

  • Syntax
    dt_TH(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass in a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_FR

  • Syntax
    dt_FR(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_SA

  • Syntax
    dt_SA(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_SU

  • Syntax
    dt_SU(A positive integer or a negative integer)
  • Parameters
    Parameter Type Required Description
    A positive integer or a negative integer Number Yes The offset. To pass a negative integer, use op_neg(positive integer).
  • Returned result

    The time that is offset.

  • Examples

    For more information about examples, see dt_MO.

dt_astimezone

  • Syntax
    dt_astimezone(value, tz=None, reset=False)
  • Parameters
    Parameter Type Required Description
    value String, UNIX timestamp, or datetime object Yes The time expression that you want to modify.
    tz String No The time zone. Default value: None. For more information, see Time zone list.
    reset Bool No Specifies whether to reset the time zone. Default value: False. The value False indicates that the function does not reset the time zone. The value True indicates that the function resets the time zone and returns the time in the specified time zone.
  • Returned result

    The datetime object in the specified time zone.

  • Examples
    • Example 1
      Raw log entry:
      time: 2019-06-03 2:41:26
      tz: UTC
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(dt_parse(v("time")), v("tz")))
      Result:
      time: 2019-06-03 2:41:26
      tz: UTC
      dt_astimezone: 2019-06-03 02:41:26+00:00
    • Example 2
      Raw log entry:
      time: 2019-06-01 10:10:10+10:00
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=True))
      Result:
      time: 2019-06-01 10:10:10+10:00
      tz: Asia/Tokyo
      dt_astimezone: 2019-06-01 10:10:10+09:00
    • Example 3
      Raw log entry:
      time: 2019-06-01 10:10:10+08:00
      tz: Asia/Tokyo
      Transformation rule:
      e_set("dt_astimezone",dt_astimezone(v("time"), v("tz"),reset=False))
      e_set("dt_astimezone_true",dt_astimezone(v("time"), v("tz"),reset=True))
      Result:
      time: 2019-06-01 10:10:10+08:00
      tz: Asia/Tokyo
      dt_astimezone: 2019-06-01 11:10:10+09:00
      dt_astimezone_true: 2019-06-01 10:10:10+09:00

dt_diff

  • Syntax
    dt_diff(value 1, value 2, unit='second', normalize='floor')
  • Parameters
    Parameter Type Required Description
    value 1 String, UNIX timestamp, or datetime object Yes Time expression 1 that you want to compare.
    value 2 String, UNIX timestamp, or datetime object Yes Time expression 2 that you want to compare.
    unit String No The precision in which you want the function to return the time difference. Default value: second. Valid values: second, microsecond, millisecond, minutes, hours, and day.
    normalize String No The numeric format in which you want the function to return the result. Valid values:
    • floor: rounds a number down to the nearest integer. Default value: floor.
    • int: removes the decimal part of a number.
    • round: retains N decimal places.
    • ceil: rounds a number up to the nearest integer.
  • Returned result

    The difference between two values, which is in the specified precision.

  • Examples
    • Example 1
      Raw log entry:
      time1: 2018-10-1 10:10:10
      time2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2")))
      Result:
      time1: 2018-10-1 10:10:10
      time2: 2018-10-1 10:10:10
      diff: 0
    • Example 2
      Raw log entry:
      time1: 2018-10-1 11:10:10
      time2: 2018-10-1 10:10:10
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2")))
      Result:
      time1: 2018-10-1 11:10:10
      time2: 2018-10-1 10:10:10
      diff: 3600
    • Example 3
      Raw log entry:
      time1: 2018-10-1 11:10:11
      time2: 2018-10-1 10:10:10
      unit: microsecond
      Transformation rule:
      e_set("diff",dt_diff(v("time1"), v("time2"),v("unit")))
      Result:
      time1: 2018-10-1 11:10:11
      time2: 2018-10-1 10:10:10
      unit: microsecond
      diff: 1000000
    • Example 4
      Raw log entry:
      time1: 2018-10-1 11:11:59
      time2: 2018-10-1 10:10:00
      unit: minute
      normalize: floor
      Transformation rule:
      dt_diff(v("time1"), v("time2"),v("unit"),v("normalize"))
      Result:
      time1: 2018-10-1 11:11:59
      time2: 2018-10-1 10:10:00
      unit: minute
      normalize: floor
      diff: 61
    • Example 5: Calculate the difference between two time values without the dates involved.
      Raw log entry:
      time1: 10:00:00
      time2: 11:00:00
      unit: second
      normalize: floor
      Transformation rule:
      dt_diff(v("time1"), v("time2"),v("unit"),v("normalize"))
      Result:
      time1: 10:00:00
      time2: 11:00:00
      unit: second
      normalize: floor
      diff: 3600