Concepts

Date and time processing in the LTS DSL syntax involves three primary data types: datetime strings, datetime objects, and Unix timestamps.

1. Datetime strings are primarily used for data display and enhancing user readability.
   In the LTS DSL syntax, datetime strings are classified into two types:

   • Datetime string with time zone information, for example, 2018-06-02 18:41:26+08:00.
   • Datetime string without time zone information, for example, 2019-06-02 10:41:26.

   For a datetime string with time zone information, the time zone is expressed by adding a time difference (offset) after the date and time. Examples:

   • 2019-06-02 18:41:26+08:00 indicates 18:41:26 on June 02, 2019, in the UTC+8:00 time zone.
   • 2019-06-02 18:41:26-07:00 indicates 18:41:26 on June 02, 2019, in the UTC-7:00 time zone.
2. Datetime object

   Datetime objects are instantiated objects of the datetime type. They are used to enhance the readability and display effect of date and time data.

3. Unix timestamp

   A Unix timestamp is the total number of seconds that have elapsed since the Unix Epoch: January 1, 1970, 00:00:00 (UTC/GMT). Unix timestamps are used in the following scenarios:

   System time: For example, the value of the collectTime field, which indicates the log receiving time in a log event, is a Unix timestamp.

   source:  192.0.2.1
   collectTime:  1562741899
   topic:

   Time-related calculation: Since a Unix timestamp is a single, linear number representing elapsed seconds, it is highly efficient for date and time calculations. Example:

   • Raw log

     {
     "time1": 1562741899,
     "time2": 1562731122
     }

   • Processing rule

     e_set("time_diff", op_sub(v("time1"), v("time2")))

   • Processing result

     {
     time1: 1562741899
     time2: 1562731122
     time_diff: 10777
     }