# Unable to rewrite timestamp using starlark processor

**URL:** <https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683>\
**Category:** Telegraf\
**Tags:** influxdb, starlark\
**Created:** [December 4, 2024, 7:52pm UTC](https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683 "2024-12-04T19:52:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam3ngland](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@adam3ngland](https://community.influxdata.com/u/adam3ngland)\
**Post date:** [December 4, 2024, 7:52pm UTC](https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683/1 "2024-12-04T19:52:10Z")

</div>

Setup: Telegraf with the tail plugin and grok data format to parse a local log file that is appended to periodically.

I want to take a timestamp from the log file, convert it to UTC, and write that back into metric.time so that I can query and graph based on the timestamp that is inside the log file that telegraf is consuming. Below is my first attempt, but I get a type error when trying to set metric.time.

What format is metric.time in? Any suggestions on how to convert my UTC time data to one that I can write to metric.time?

```
year = str(metric.fields["year"])
month = str(metric.fields["month"])
day = str(metric.fields["day"])
hours = str(metric.fields.get("hours", "00"))
minutes = str(metric.fields.get("minutes", "00"))
seconds = str(metric.fields.get("seconds", "00"))

utc_timestamp = year + "-" + month + "-" + day + "T" + hours + ":" + minutes + ":" + seconds + "Z"

utc_parsed_time = time.parse_time(utc_timestamp)
metric.time = utc_parsed_time

```

---

<div class="post-metadata">

**Author:** ![adam3ngland](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@adam3ngland](https://community.influxdata.com/u/adam3ngland)\
**Post date:** [December 5, 2024, 9:33pm UTC](https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683/2 "2024-12-05T21:33:17Z")

</div>

metric.time is in nanoseconds. the below line is what I used to rewrite the timestamp

utc\_parsed\_time = time.parse\_time(utc\_timestamp,“2006-01-02T15:04:05Z”).unix\_nano

That unix\_nano was the magic I was looking for

---

<div class="post-metadata">

**Author:** ![Anaisdg](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/anaisdg/32/6401_2.png) [@Anaisdg](https://community.influxdata.com/u/Anaisdg)\
**Post date:** [December 6, 2024, 9:03pm UTC](https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683/3 "2024-12-06T21:03:37Z")

</div>

@adam3ngland  
Thanks so much for sharing your solution and welcome! What are you using Influxdb for out of curiosity?

---

<div class="post-metadata">

**Author:** ![adam3ngland](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@adam3ngland](https://community.influxdata.com/u/adam3ngland)\
**Post date:** [December 6, 2024, 9:45pm UTC](https://community.influxdata.com/t/unable-to-rewrite-timestamp-using-starlark-processor/39683/4 "2024-12-06T21:45:48Z")

</div>

Normally just influxdb + telegraf + grafana for system metrics and visibility. This use case came up when we wanted/needed to ingest a 3rd party log file and create some dashboards from it, but query based on when the data was written to the log, not when telegraf learned about it. Bit of a weird use case, but that’s what we get for looking at logs much later 🤷