I give up; here's an explicit timestamp filter

yagi/filters.py

@@ -1,11 +1,26 @@
+import datetime
 import json
 
 
-class FilterMessageMatch(object):
+class FilterMessage(object):
     def __init__(self, map_file):
         with open(map_file, 'r') as f:
             self.transform_dict = json.load(f)
 
+    def transform(self, mapping, message):
+        for k, v in mapping.iteritems():
+            if isinstance(message, dict) and message.get(k):
+                if isinstance(message[k], dict):
+                    self.transform(v, message[k])
+                else:
+                    message[k] = v
+        return message
+
+    def __call__(self, message):
+        return self.transform(self.transform_dict, message)
+
+
+class FilterMessageMatch(FilterMessage):
     def transform(self, mapping, message):
         for k, v in mapping.iteritems():
             if isinstance(message, dict) and message.get(k):
@@ -19,19 +34,19 @@ def transform(self, mapping, message):
             else:
                 if unicode(k) == message:
                     return v
-
         return message
 
-    def __call__(self, message):
-        return self.transform(self.transform_dict, message)
-
 
-class FilterMessage(FilterMessageMatch):
+class FilterMessageTimestamp(FilterMessage):
     def transform(self, mapping, message):
         for k, v in mapping.iteritems():
             if isinstance(message, dict) and message.get(k):
                 if isinstance(message[k], dict):
                     self.transform(v, message[k])
                 else:
-                    message[k] = v
+                    audit = datetime.datetime.strptime(message[k],
+                                                       '%Y-%m-%d %H:%M:%S')
+
+                    delta = datetime.timedelta(hours=int(v))
+                    message[k] = str(audit + delta)
         return message