Skip to content

feat: LQL timestamp support for unix timestamps and ISO8601#3327

Merged
Ziinc merged 2 commits intoLogflare:mainfrom
msmithstubbs:feat/o11y-1586
Apr 15, 2026
Merged

feat: LQL timestamp support for unix timestamps and ISO8601#3327
Ziinc merged 2 commits intoLogflare:mainfrom
msmithstubbs:feat/o11y-1586

Conversation

@msmithstubbs
Copy link
Copy Markdown
Contributor

@msmithstubbs msmithstubbs commented Apr 1, 2026

Add support for LQL timestamp filters in these formats:

Unix timestamp

Use Unix timestamps as 10-digit seconds, 13-digit milliseconds, or 16-digit microseconds.
Microsecond values are truncated to milliseconds.
Unix timestamps are interpreted as UTC.

Examples:

  • t:>=1710683222000
  • t:<=1710683222000000
  • t:1710683222..1710683822
  • t:1710683222000..1710683822000

ISO8601 format

A timestamp can be written as:

  1. A datetime with a Z suffix
    This is treated as a UTC datetime.
  2. A datetime with an explicit timezone offset
    This is treated using the supplied offset.

Examples:

  • t:2026-03-17..2026-03-19
  • t:>2026-03-17T14:47:02Z
  • t:>=2026-03-17T14:47:02.123Z
  • t:<2026-03-17T14:47:02+02:00
  • t:>=2026-03-17T14:47:02-02:00
  • t:2026-03-17T14:47:02+02:00..2026-03-17T15:47:02+02:00
CleanShot.2026-04-13.at.09.53.24.mp4
CleanShot.2026-04-13.at.09.58.04.mp4

Closes O11Y-1586

@msmithstubbs msmithstubbs force-pushed the feat/o11y-1586 branch 2 times, most recently from 6a3d953 to 2e426af Compare April 12, 2026 23:50
@msmithstubbs msmithstubbs marked this pull request as ready for review April 13, 2026 00:07
@msmithstubbs msmithstubbs marked this pull request as draft April 13, 2026 00:26
@msmithstubbs msmithstubbs force-pushed the feat/o11y-1586 branch 2 times, most recently from deca498 to d68c264 Compare April 13, 2026 05:22
@msmithstubbs msmithstubbs marked this pull request as ready for review April 13, 2026 06:12
Comment on lines +330 to +337
assert Enum.map(rules, & &1.modifiers) == [
%{explicit_timezone: true},
%{explicit_timezone: true},
%{explicit_timezone: true},
%{explicit_timezone: true},
%{explicit_timezone: true},
%{explicit_timezone: true}
]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could be an Enum.all?(...)

Comment on lines +312 to +328
assert Enum.map(rules, & &1.value) == [
~N[2026-03-17 14:47:02.000],
~N[2026-03-17 12:47:02],
~N[2026-03-17 16:47:02],
nil,
nil,
~N[2024-03-17 13:47:02.000]
]

assert Enum.map(rules, & &1.values) == [
nil,
nil,
nil,
[~N[2024-03-17 13:47:02], ~N[2024-03-17 13:57:02]],
[~N[2024-03-17 13:47:02.000], ~N[2024-03-17 13:57:02.000]],
nil
]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

splitting up the range query substrings would be more readable

@Ziinc Ziinc merged commit 1a59de3 into Logflare:main Apr 15, 2026
13 checks passed
Ziinc pushed a commit that referenced this pull request Apr 15, 2026
* feat: LQL timestamp support for unix timestamps and ISO8601

* fix: don't apply local timezone correction to absolute timestamps
Ziinc added a commit that referenced this pull request Apr 15, 2026
* feat: initial implementation of bigquery iam provisioning

* chore: remove stripe-mock and add in price id to seeds for paid plan testing

* chore: add stripe helper

* docs: add docs on additional bigquery projects

* chore: version bump

* chore: instance template scripts (#3369)

* feat: LQL timestamp support for unix timestamps and ISO8601 (#3327)

* feat: LQL timestamp support for unix timestamps and ISO8601

* fix: don't apply local timezone correction to absolute timestamps

* feat: add partial broadcast for cached values (#3218)

* add partial cache broadcast on misses

* credo

* credo again

* naming

* comment

* comments

* naming

* continue

* credo

* wording

* continue

* fewer changes

* add refresh

* begin tests

* seems to work

* add key to telemetry info

* add key to telemetry info

* doc

* fix credo warning

* extract gossip functions into own module

* fix mime error

* continue

* move epmd setup to ci

* use ; instead of &&

* seems to work

* cleanup

* cleanup again

* add big error if epmd is not running

* cleanup

* format error

* improve float parsing (allow 0 and 1)

* add warnings

* pipe

* comment on epmd

* move comment

* move unboxed runs to setup from setup_all

* cache user

* continue

* cleanup

* continue

* more logs

* wording

* comment

* naming

* eh

* notice

---------

Co-authored-by: Ziinc <Ziinc@users.noreply.github.com>

* chore: add telegraf

---------

Co-authored-by: Adam Mokan <amokan@gmail.com>
Co-authored-by: Matt Stubbs <22266+msmithstubbs@users.noreply.github.com>
Co-authored-by: ruslandoga <ruslandoga+gh@icloud.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants