Parse Timestamp

Overview

The Parse Timestamp processor parses event time values from logs and sets either the event time or observed_time.

It supports both strptime patterns and epoch-based timestamp formats.

Supported types: Logs

Configuration

Parameter	Type	Default	Required	Description
field_type	string	—	Yes	Source type: attribute, body, or resource.
field	string	—	Conditional	Source key when needed by selected field_type.
format_type	string	—	Yes	Timestamp format type: strptime, epoch_seconds, epoch_millis, epoch_micros, or epoch_nanos.
format	string	—	Conditional	Required when format_type is strptime.
timezone	string	—	No	Optional IANA timezone when source value has no timezone.
target_field	string	time	No	Target field: time or observed_time.

Example Configuration

{
  "field_type": "attribute",
  "field": "timestamp",
  "format_type": "strptime",
  "format": "%Y-%m-%dT%H:%M:%S%z",
  "timezone": "UTC",
  "target_field": "time"
}