Date and time operators
FuseQL date and time operators work with timestamps and query time boundaries, enabling time-based enrichment and filtering.
formatdate
Converts an epoch millisecond timestamp to a human-readable date string using a specified format pattern and optional timezone (default UTC). Use formatdate to produce readable timestamps for display, grouping by time period, or labeling output rows — for example, converting now() or a parsed epoch field to a date string for dashboards.
Syntax
| formatdate(<dateMilliseconds>) as <alias>
| formatdate(<dateMilliseconds>, <formatString>) as <alias>
| formatdate(<dateMilliseconds>, <formatString>, <timezoneString>) as <alias>Parameters
| Parameter | Required | Description |
|---|---|---|
|
Required |
An epoch millisecond timestamp field or expression to format. |
|
Optional |
A date format pattern using Java |
|
Optional |
A timezone identifier such as |
|
Required |
Name for the resulting string field. |
Example
Format the current time as a human-readable date string and return the first value per HTTP method.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| formatdate(now(), "yyyy-MM-dd HH:mm") as ts_str
| first(ts_str) by method| method | first(ts_str) |
|---|---|
GET |
2026-06-27 18:52 |
POST |
2026-06-27 18:52 |
|
The exact output depends on the time the query runs. Common format tokens: |
now
Returns the current epoch time in milliseconds at the moment the query executes. Use now() to compute time-relative expressions — for example, calculating how long ago an event occurred by subtracting a parsed timestamp from the current time.
Parameters
| Parameter | Required | Description |
|---|---|---|
(none) |
— |
|
|
Required |
Name for the resulting millisecond epoch timestamp field. |
Example
Capture the current time as a millisecond epoch value and convert it to a human-readable date string.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| now() as ts
| formatdate(ts, "yyyy-MM-dd HH:mm") as ts_str
| first(ts_str) by method| method | first(ts_str) |
|---|---|
GET |
2026-06-27 18:52 |
POST |
2026-06-27 18:52 |
|
The raw millisecond value of |
parsedate
Parses a date string using a specified format pattern and optional timezone (default UTC), and returns the corresponding epoch milliseconds as a long integer. Use parsedate to convert human-readable timestamps extracted from log fields into numeric epoch values for arithmetic, filtering, or comparison — for example, finding the earliest request timestamp in a window.
Syntax
| parsedate(<dateString>, <formatString>) as <alias>
| parsedate(<dateString>, <formatString>, <timezoneString>) as <alias>Parameters
| Parameter | Required | Description |
|---|---|---|
|
Required |
A string field or literal containing the date to parse. |
|
Required |
A date format pattern matching the input string, using Java |
|
Optional |
A timezone identifier such as |
|
Required |
Name for the resulting epoch millisecond field. |
Example
Parse the nginx access log date field (format dd/MMM/yyyy:HH:mm:ss Z) into epoch milliseconds and return the earliest timestamp in the window.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| parsedate("dd/MMM/yyyy:HH:mm:ss Z", date) as ts_ms
| min(ts_ms) as earliest| earliest |
|---|
1782582780123 |
|
Values shown are illustrative; actual results depend on your log data and the selected time window. |
queryendtime
Returns the end time of the current query window as epoch milliseconds. Use queryendtime() to reference the boundary of the selected time range — for example, to compute the elapsed time between an event timestamp and the window end.
Parameters
| Parameter | Required | Description |
|---|---|---|
(none) |
— |
|
|
Required |
Name for the resulting millisecond epoch timestamp field. |
Example
Return the query window end time as both a raw epoch value and a formatted date string.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| queryendtime() as end_ts
| formatdate(end_ts, "yyyy-MM-dd HH:mm:ss") as end_str
| first(end_str) by method| method | first(end_str) |
|---|---|
GET |
2026-06-27 18:53:00 |
POST |
2026-06-27 18:53:00 |
|
The raw millisecond value from this query window was |
querystarttime
Returns the start time of the current query window as epoch milliseconds. Use querystarttime() to reference the beginning of the selected time range — for example, to filter events relative to the window start or to label output with the range boundaries.
Parameters
| Parameter | Required | Description |
|---|---|---|
(none) |
— |
|
|
Required |
Name for the resulting millisecond epoch timestamp field. |
Example
Return the query window start time as both a raw epoch value and a formatted date string.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| querystarttime() as start_ts
| formatdate(start_ts, "yyyy-MM-dd HH:mm:ss") as start_str
| first(start_str) by method| method | first(start_str) |
|---|---|
GET |
2026-06-27 17:53:00 |
POST |
2026-06-27 17:53:00 |
|
The raw millisecond value from this query window was |
querytimerange
Returns the total duration of the current query window in milliseconds. Use querytimerange() to scale per-window aggregations to a rate — for example, dividing an event count by the window duration to compute events per second regardless of the selected time range.
Parameters
| Parameter | Required | Description |
|---|---|---|
(none) |
— |
|
|
Required |
Name for the resulting millisecond duration field. |
Example
Compute the request rate (requests per second) for each HTTP method by dividing the count by the query window duration.
source="nginx"
| parse "* - - [*] \"* *\" * * *" as ip,date,method,url,status,bytes,rest
| count by method
| querytimerange() as window_ms
| eval((_count / window_ms) * 1000) as rps| method | _count | rps |
|---|---|---|
POST |
2,159,649 |
599.9 |
GET |
3,091 |
0.86 |
HEAD |
183 |
0.05 |
|
The raw millisecond value from this query window was |
