Parsing date strings

Problem / Use Case

You have ISO 8601 formatted timestamps (or similar) as strings (e.g., from log fields or external inputs), and you want to convert them into a readable datetime format for dashboards or further processing. Use parseTimestamp and formatTimestamp to make the conversion possible.

Query

create parsed from parseTimestamp('2025-04-29T05:53:02.439Z', 'iso8601')
| create formatted_time from formatTimestamp(parsed, '%Y-%m-%d %H:%M:%S')

Output

{
  "parsed": 2025-04-29T05:53:02.439Z,
  "formatted_time": "2025-04-29 05:53:02"
}

Variations

Format as date only: '%Y-%m-%d'
Include timezone offset: formatTimestamp(parsed, '%Y-%m-%d %H:%M:%S', 'UTC')
Format as timestamp in milliseconds: 'timestamp_milli'

TL;DR

Use parseTimestamp to interpret strings as timestamps, then formatTimestamp to convert them into readable strings. Works great for standardizing date fields across logs.

Find peak traffic

Next Create variables for timestamp calculations