Auto Timestamp
Synopsis
Tries an ordered list of regex / strptime rules against src_field, parses the first rule that both matches and falls within the configured bounds, and writes the resulting instant to dst_field. auto_timestamp is the native implementation of Cribl's Auto Timestamp function.
Schema
- auto_timestamp:
timestamps:
- regex: <string>
strptime: <string>
src_field: <ident>
dst_field: <ident>
time_expression: <script>
max_len: <integer>
default_time: <string>
earliest_date_allowed: <string>
latest_date_allowed: <string>
default_timezone: <string>
filter: <script>
tag: <string>
description: <text>
if: <script>
disabled: <boolean>
ignore_failure: <boolean>
on_failure: <processor[]>
on_success: <processor[]>
Configuration
| Field | Required | Default | Description |
|---|---|---|---|
timestamps | Y | Ordered list of regex / strptime rules. Tried in order; the first rule that both matches and parses within bounds wins. | |
src_field | N | _raw | Log entry field read as the source text. |
dst_field | N | _time | Log entry field the resolved instant is written to. |
time_expression | N | time.getTime() / 1000 | JavaScript expression evaluated against a time Date binding. Left at its default, the processor takes a fast path that writes plain epoch seconds without any JavaScript evaluation. |
max_len | N | 150 | Truncates src_field (by rune count) before any rule is tried. |
default_time | N | Only the exact value now (case-insensitive, trimmed) writes the current time when no rule matched. Any other value, including leaving it unset, leaves dst_field untouched. | |
earliest_date_allowed | N | Relative offset only (e.g. -420weeks), never an absolute date. An unparseable value is silently ignored — no lower bound is applied. | |
latest_date_allowed | N | Relative offset only (e.g. +1week), never an absolute date. An unparseable value is silently ignored — no upper bound is applied. | |
default_timezone | N | IANA time zone name that re-anchors a parsed wall-clock time. An unresolvable zone is silently ignored, and the field is skipped entirely when the winning rule's strptime format already carries absolute offset/epoch information. | |
filter | N | Cribl-style JavaScript truthiness expression evaluated after if. A falsy result silently skips the processor. Distinct from if, which uses the native expression language. | |
tag | N | Identifier for this processor instance. | |
description | N | Explanatory note. | |
if | N | Condition that must be true for the processor to run. | |
disabled | N | false | When true, the processor is skipped. |
ignore_failure | N | false | Continue pipeline processing if the processor fails. |
on_failure | N | Processors to run when this processor fails. | |
on_success | N | Processors to run when this processor passes an event through. |
Timestamps
| Field | Required | Default | Description |
|---|---|---|---|
regex | Y | Pattern used to locate the timestamp substring within src_field. Either a bare pattern (applied with no flags) or a /pattern/flags delimited literal. Supported flags: i, m, s, u — a g flag, if present, has no effect, since only the first match is ever used. Uses capture group 1 (JS/left-to-right numbering) when the pattern has one, otherwise the whole match. | |
strptime | Y | C/d3-style format string (e.g. %a %b %d %H:%M:%S %Y, %Y-%m-%d, %s) used to parse the text regex located. |
Details
auto_timestamp is the native implementation of Cribl's Auto Timestamp function. timestamps is tried in declaration order against src_field (truncated to max_len runes first): for each rule, regex must match and the text it locates must parse under strptime and fall within earliest_date_allowed/latest_date_allowed. The first rule that satisfies all three wins and stops the search; every other rule is left untried.
A rule whose regex doesn't match src_field, whose matched text doesn't parse under strptime, or whose parsed time falls outside the configured bounds is not a processor failure — it is simply not a match, and the next rule in timestamps is tried. Only a genuinely malformed regex spec, a missing or non-string src_field, or a time_expression compile/evaluation failure fails the processor (see below).
earliest_date_allowed and latest_date_allowed accept relative offsets only, never absolute dates: a leading + or - sign, one or more digits, optional whitespace, then one of week, weeks, day, days, hour, hours (e.g. -420weeks, +1 week). Each bound is evaluated independently against the current time at the moment the processor runs; a value that doesn't match this grammar (including an absolute date string) is silently ignored, imposing no constraint on that side rather than raising an error.
If no rule in timestamps matches within bounds, default_time decides the outcome: only the value now, compared case-insensitively after trimming whitespace, writes the current time to dst_field. Any other value — an absolute date, a typo, or leaving the field unset entirely — leaves dst_field untouched, with no error raised.
default_timezone re-anchors a parsed wall-clock reading into the named IANA zone. strptime always parses in UTC, so the parsed year/month/day/hour/minute/second digits are, by default, treated as UTC; setting default_timezone reinterprets those same digits as local time in the given zone instead, producing a different absolute instant. An unresolvable zone name is silently ignored, leaving the UTC-parsed instant unchanged. default_timezone is skipped entirely — regardless of whether it resolves — when the winning rule's strptime format contains %z, %Z, %s, or %Q: each of these directives already pins the parse to a genuine absolute instant (an explicit offset or an epoch value), so re-anchoring it into another zone would silently shift the timestamp rather than leave an already-unambiguous instant alone.
time_expression controls how the resolved instant is written to dst_field. The fast path — writing plain epoch seconds as a number, with no JavaScript involved — triggers only when time_expression is left empty or set to the exact literal time.getTime() / 1000 (trimmed of leading/trailing whitespace only; an equivalent but differently-spaced expression such as time.getTime()/1000 does not qualify). Any other value is compiled and evaluated as a JavaScript expression against a time binding — a genuine JS Date object constructed from the resolved instant — and whatever the expression returns is written to dst_field verbatim, whether that's a number, a string, or any other JS value. A time_expression that fails to compile or evaluate fails the processor.
filter provides the same Cribl-style JavaScript truthiness gate available on other Cribl-compatible processors such as Rewrite. It is evaluated after if; a falsy result skips the processor entirely without an error, leaving the event unmodified. filter is not a universal field available on every processor. time_expression shares its underlying JavaScript expression engine with Eval, though each processor maintains its own compiled-expression cache.
A missing or non-string src_field fails the processor with an error of the form auto_timestamp: source field "<field>": <error> or auto_timestamp: source field "<field>" is not a string. A malformed regex spec in any rule fails with auto_timestamp: regex "<pattern>": <error>. A time_expression compile or evaluation failure fails with auto_timestamp: time_expression "<expr>": <error>.
Examples
Basic Timestamp Extraction
Locating a ctime-style timestamp inside a raw log line and parsing it with a matching | |
The rule matches and parses; | |
Silently Skipped default_time Value
Setting | |
No rule matches and | |
Relative Date Bounds Reject an Out-of-Range Match
Bounding matches to within a week of now using relative offsets — the 2006 date in | |
The rule matches and parses, but the result falls outside the bounds — treated as a non-match, not a failure — and | |
Custom time_expression
Extracting just the year from the parsed instant with a custom | |
Since | |
default_timezone Re-anchors a Timezone-less Timestamp
Parsing a timestamp with no timezone information, then re-anchoring its wall-clock digits as local time in | |
| |
Epoch Directive Ignores default_timezone
Parsing an epoch-seconds value with | |
| |