Format Email Timestamp

[tugatobito]

Is there a way to format the timestamp that goes on the alert?

Im using the default timestamp field.

I would like something "6 May of 2021 at 9:30am".

I've being trying to change the python util.py file but without success, the timefield always goes to back to that mess.

[jertel]

If you're referring to the list of match key/value pairs that get dumped into the alert body then no, I don't believe you can format the values. It's using the default python string conversion value_str = str(value) found in alerts.py::_add_match_items::127.

[jertel]

Ok, in that case you will need to make changes on a different line. Look at alerts.py around line 83.

                    if alert_value:
                        alert_text_values[i] = alert_value

You will need to check the type of alert_value and if it's a timestamp then format it.

[tugatobito]

I found the line and tried with this.

or even

but the output is the same. It seems that the code just doesnt change or something.

[jertel]

Sounds like you're not modifying the code that's actually being executed. I can't offer much assistance since I am not familiar with your setup.

[nsano-rururu]

@tugatobito

I feel that the settings of timestamp_field and timestamp_type and timestamp_format are related.

https://elastalert2.readthedocs.io/en/latest/ruletypes.html#timestamp-type

Yelp/elastalert#616
Yelp/elastalert#1701

timestamp_field: timestamp
timestamp_type: custom
timestamp_format: "%d.%m.%Y %H:%M:%S"
Yelp/elastalert#996
timestamp_field: timestamp
timestamp_type: custom
timestamp_format: '%Y-%m-%d %H:%M:%S.%f'
timestamp_format_expr: 'ts[:23] + ts[26:]'

[nsano-rururu]

https://github.com/jertel/elastalert2/blob/master/elastalert/loaders.py#L287

        rule.setdefault('timestamp_field', '@timestamp')
        rule.setdefault('filter', [])
        rule.setdefault('timestamp_type', 'iso')
        rule.setdefault('timestamp_format', '%Y-%m-%dT%H:%M:%SZ')

https://github.com/jertel/elastalert2/blob/master/elastalert/loaders.py#L308

        elif rule['timestamp_type'] == 'custom':
            def _ts_to_dt_with_format(ts):
                return ts_to_dt_with_format(ts, ts_format=rule['timestamp_format'])

            def _dt_to_ts_with_format(dt):
                ts = dt_to_ts_with_format(dt, ts_format=rule['timestamp_format'])
                if 'timestamp_format_expr' in rule:
                    # eval expression passing 'ts' and 'dt'
                    return eval(rule['timestamp_format_expr'], {'ts': ts, 'dt': dt})
                else:
                    return ts

            rule['ts_to_dt'] = _ts_to_dt_with_format
            rule['dt_to_ts'] = _dt_to_ts_with_format