Functions reference

Function name Remarks
TO_DATETIME(dateTimeStr, formatStr)

Converts the specified string representation of a date and time (dateTimeStr) to DateTime using the specified format (formatStr). The list of available format specifiers is here: Custom Date and Time Format Strings.

Examples:

TO_DATETIME(date, "yyyy-MM-ddTHH:mm:ss.fffffffZ")

TO_DATETIME(time, "y/MM/dd HH:mm:ss") note: thit code parses locale-dependent date separaror. Try to avoid formatting your logs locale dependent ways because it may fail the log viewing if log writer and viewer have different locales.

TO_DATETIME(date, "yyyy'/'MM'/'dd HH:mm:ss") note: thit code has hardcoded separator / that does not depend on user's locale.

HEX_TO_INT(hexStr) Converts the hex string representation of an integer to System.Integer value.

Examples:

HEX_TO_INT("F3A7")
HEX_TO_INT(hexCapture)
TO_INT(intStr) Converts the string representation of an integer to System.Integer value.

Examples:

TO_INT("42")
TO_INT(intCapture)
TO_INT(intStr, startIdx, len) Converts the part of string to System.Integer value.

Examples:

TO_INT("foo42bar", 3, 2)

TO_INT(complexCapture, 3, 2) extracts second integer from the capture taken by regex (?<complexCapture>\d{2}-\d{2}-\d{2})

TRIM(str) Cuts insignificant spaces from the beginning and the end of the specified string. Insignificant spaces are '\t', '\n', '\r', ' '.
PARSE_YEAR(stringYear) Converts the specified value to integer value. Then the value is processed this way:
  • If the value is greater than 100, it is returned as is.
  • If the value is greater than 60, (2000 + year) is returned.
  • (1900 + year) is returned otherwise.
EPOCH_TIME(intEpochTime) Converts integer epoch time (Unix time) to DateTime object.
SOURCE_TIME() Returns the DateTime that represents the last modification time of the log file.
DATETIME_FROM_TIMEOFDAY(timeOfDayDateTime) timeOfDayDateTime is DateTime that represents only time information. DATETIME_FROM_TIMEOFDAY() makes complete DateTime object that includes date information. It uses SOURCE_TIME() to take the date of the log. This function is useful for the logs that don't store dates, only time of day.
NEW_LINE() Returns the string containing new line charachter(s). \n on mono, \r\n on win.
INPUT_FIELDS_COUNT() Returns total number of input captures
INPUT_FIELD_VALUE(zeroBasedIndex) Returns the StringSlice object for a regex capture by index. It's an alternative way to access regex captures (the main way is via named variables)
INPUT_FIELD_NAME(zeroBasedIndex) Returns the System.String object with the name of regex capture with given index
POSITION() Returns System.Int64 file stream position of the log message being parsed.