Type to search.

Date processor

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack GA 9.2+ …

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.2

    This functionality is generally available and ready for production usage.

  • Preview in 9.1

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Date processor parses dates from fields, and then uses the date or timestamp as the timestamp for the document.

To extract a timestamp field using the date processor:

  1. Select Create → Create processor.
  2. Select Date from the Processor menu.
  3. Set the Source Field to the field containing the timestamp.
  4. Set the Format field to one of the accepted date formats (ISO8601, UNIX, UNIX_MS, or TAI64N) or use a Java time pattern. Refer to the example formats for more information.

This functionality uses the Elasticsearch Date processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

The following list provides some common examples of date formats and how to parse them.

Common formats

Text 
2025-04-04T09:04:45+00:00 => ISO8601
1618886400 => UNIX
1618886400123 => UNIX_MS
4000000049c9f0ca => TAI64N

Custom formats

Text 
2023-10-15 => yyyy-MM-dd
15/10/2023 => dd/MM/yyyy
10-15-2023 => MM-dd-yyyy
2023-288 => yyyy-DDD
15 Oct 2023 => dd MMM yyyy
Sunday, October 15, 2023 => EEEE, MMMM dd, yyyy
2023-10-15T14:30:00Z => yyyy-MM-dd'T'HH:mm:ssX
2023-10-15 14:30:00 => yyyy-MM-dd HH:mm:ss

You can set the following optional fields for the date processor in the Advanced settings:

Field Description
Target field The field that will hold the parsed date. Defaults to @timestamp.
Timezone The timezone to use when parsing the date. Supports template snippets. Defaults to UTC.
Locale The locale to use when parsing the date, relevant when parsing month names or weekdays. Supports template snippets. Defaults to ENGLISH.
Output format The format to use when writing the date to target_field. Must be a valid Java time pattern. Defaults to yyyy-MM-dd'T'HH:mm:ss.SSSXXX.

In YAML mode, configure the date processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Source field containing the date string.
formats string[] Yes Date formats to try, in order (for example, ISO8601, UNIX, or a Java time pattern).
to string No Target field for the parsed date. Defaults to @timestamp.
timezone string No Timezone to use when parsing. Defaults to UTC.
locale string No Locale to use when parsing month names or weekdays. Defaults to ENGLISH
output_format string No Format for the output date string. Must be a valid Java time pattern.
YAML 
- action: date
  from: attributes.timestamp
  formats:
    - ISO8601