Parsing date strings

Problem / Use case

You have ISO 8601 formatted timestamps (or similar) as strings (e.g., from log fields or external inputs), and you want to convert them into a readable datetime format for dashboards or further processing. Use parseTimestamp and formatTimestamp to make the conversion possible.

Query

create parsed from parseTimestamp('2025-04-29T05:53:02.439Z', 'iso8601')
| create formatted_time from formatTimestamp(parsed, '%Y-%m-%d %H:%M:%S')

Output

{
  "parsed": 2025-04-29T05:53:02.439Z,
  "formatted_time": "2025-04-29 05:53:02"
}

Variations

• Format as date only: '%Y-%m-%d'
• Include timezone offset: formatTimestamp(parsed, '%Y-%m-%d %H:%M:%S', 'UTC')
• Format as timestamp in milliseconds: 'timestamp_milli'

TL;DR

Use parseTimestamp to interpret strings as timestamps, then formatTimestamp to convert them into readable strings. Works great for standardizing date fields across logs.