As Datadog receives dates, it timestamps them using the value(s) from any of these default attributes:

• timestamp
• date
• _timestamp
• Timestamp
• eventTime
• published_date

If your events have dates in an attribute that are not in this list, use the date remapper processor to define their date attribute as the official event timestamp:

If your events don’t have a timestamp that conforms to the formats listed above, use the grok processor to extract the epoch time from the timestamp to a new attribute. The date remapper uses the newly defined attribute.

To see how a custom date and time format can be parsed in Datadog, see Parsing dates.

Notes:

• As of ISO 8601-1:2019, the basic format is T[hh][mm][ss] and the extended format is T[hh]:[mm]:[ss]. Earlier versions omitted the T (representing time) in both formats.
• If multiple date remapper processors are applied to a given pipeline, the last one (according to the pipeline’s order) is taken into account.

Example date remapper processor