Stay organized with collections
Save and categorize content based on your preferences.
timestamp.get_date
timestamp.get_date(unix_seconds [, time_zone])
Description
This function returns a string in the format YYYY-MM-DD, representing the day a timestamp is in.
unix_seconds is an integer representing the number of seconds past Unix
epoch, such as $e.metadata.event_timestamp.seconds, or a placeholder
containing that value.time_zone is optional and is a string representing a time_zone. If
omitted, the default is "GMT". You can specify time zones using string
literals. The options are:
- The TZ database name, for example "America/Los_Angeles". For more
information, see the "TZ Database Name" column from this page
- The time zone offset from UTC, in the format
(+|-)H[H][:M[M]],
for example: "-08:00".
Here are examples of valid time_zone specifiers, which you can pass as the second argument to time extraction functions:
"America/Los_Angeles", or "-08:00". ("PST" is not supported)
"America/New_York", or "-05:00". ("EST" is not supported)
"Europe/London"
"UTC"
"GMT"
Param data types
INT, STRING
Return type
STRING
Code samples
Example 1
In this example, the time_zone argument is omitted, so it defaults to "GMT".
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_date($ts) = "2024-02-19"
Example 2
This example uses a string literal to define the time_zone.
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_date($ts, "America/Los_Angeles") = "2024-02-20"
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-07-14 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003eThe \u003ccode\u003etimestamp.get_date\u003c/code\u003e function extracts the date in \u003ccode\u003eYYYY-MM-DD\u003c/code\u003e format from a Unix timestamp.\u003c/p\u003e\n"],["\u003cp\u003eIt requires an integer representing the Unix timestamp in seconds as input, and can also optionally take a string specifying the time zone.\u003c/p\u003e\n"],["\u003cp\u003eIf the time zone is not specified, the function defaults to "GMT".\u003c/p\u003e\n"],["\u003cp\u003eValid time zone formats include TZ database names like "America/Los_Angeles" or offsets like "-08:00", but abbreviations like "PST" or "EST" are not supported.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns a string representing the date in \u003ccode\u003eYYYY-MM-DD\u003c/code\u003e format.\u003c/p\u003e\n"]]],[],null,["### timestamp.get_date\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n timestamp.get_date(unix_seconds [, time_zone])\n\n#### Description\n\nThis function returns a string in the format `YYYY-MM-DD`, representing the day a timestamp is in.\n\n- `unix_seconds` is an integer representing the number of seconds past Unix epoch, such as `$e.metadata.event_timestamp.seconds`, or a placeholder containing that value.\n- `time_zone` is optional and is a string representing a time_zone. If omitted, the default is \"GMT\". You can specify time zones using string literals. The options are:\n - The TZ database name, for example \"America/Los_Angeles\". For more information, see the [\"TZ Database Name\" column from this page](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)\n - The time zone offset from UTC, in the format`(+|-)H[H][:M[M]]`, for example: \"-08:00\".\n\nHere are examples of valid time_zone specifiers, which you can pass as the second argument to time extraction functions: \n\n \"America/Los_Angeles\", or \"-08:00\". (\"PST\" is not supported)\n \"America/New_York\", or \"-05:00\". (\"EST\" is not supported)\n \"Europe/London\"\n \"UTC\"\n \"GMT\"\n\n#### Param data types\n\n`INT`, `STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, the `time_zone` argument is omitted, so it defaults to \"GMT\". \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_date($ts) = \"2024-02-19\"\n\n##### Example 2\n\nThis example uses a string literal to define the `time_zone`. \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_date($ts, \"America/Los_Angeles\") = \"2024-02-20\""]]
