使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
timestamp.get_date
timestamp.get_date(unix_seconds [, time_zone])
说明
此函数会返回一个格式为 YYYY-MM-DD 的字符串，表示时间戳所在的日期。
unix_seconds 是一个表示经过 Unix 计时原点的秒数（例如 $e.metadata.event_timestamp.seconds）的整数，或一个包含该值的占位符。time_zone 是可选的，是表示时区的字符串。如果省略，则默认值为“GMT”。您可以使用字符串字面量来指定时区。选项包括：
- TZ 数据库名称，例如“America/Los_Angeles”。如需了解详情，请参阅本页中的“TZ 数据库名称”列
- 相对于世界协调时间 (UTC) 的时区偏离值，格式为
(+|-)H[H][:M[M]]，例如“-08:00”。
以下是有效 time_zone 说明符的示例，您可以将其作为第二个实参传递给时间提取函数：
"America/Los_Angeles", or "-08:00". ("PST" is not supported)
"America/New_York", or "-05:00". ("EST" is not supported)
"Europe/London"
"UTC"
"GMT"
形参数据类型
INT，STRING
返回类型
STRING
代码示例
示例 1
在此示例中，省略了 time_zone 实参，因此默认值为“GMT”。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_date($ts) = "2024-02-19"
示例 2
以下示例使用字符串字面量来定义 time_zone。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_date($ts, "America/Los_Angeles") = "2024-02-20"
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-29。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003eThe \u003ccode\u003etimestamp.get_date\u003c/code\u003e function extracts the date in \u003ccode\u003eYYYY-MM-DD\u003c/code\u003e format from a Unix timestamp.\u003c/p\u003e\n"],["\u003cp\u003eIt requires an integer representing the Unix timestamp in seconds as input, and can also optionally take a string specifying the time zone.\u003c/p\u003e\n"],["\u003cp\u003eIf the time zone is not specified, the function defaults to "GMT".\u003c/p\u003e\n"],["\u003cp\u003eValid time zone formats include TZ database names like "America/Los_Angeles" or offsets like "-08:00", but abbreviations like "PST" or "EST" are not supported.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns a string representing the date in \u003ccode\u003eYYYY-MM-DD\u003c/code\u003e format.\u003c/p\u003e\n"]]],[],null,["### timestamp.get_date\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n timestamp.get_date(unix_seconds [, time_zone])\n\n#### Description\n\nThis function returns a string in the format `YYYY-MM-DD`, representing the day a timestamp is in.\n\n- `unix_seconds` is an integer representing the number of seconds past Unix epoch, such as `$e.metadata.event_timestamp.seconds`, or a placeholder containing that value.\n- `time_zone` is optional and is a string representing a time_zone. If omitted, the default is \"GMT\". You can specify time zones using string literals. The options are:\n - The TZ database name, for example \"America/Los_Angeles\". For more information, see the [\"TZ Database Name\" column from this page](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)\n - The time zone offset from UTC, in the format`(+|-)H[H][:M[M]]`, for example: \"-08:00\".\n\nHere are examples of valid time_zone specifiers, which you can pass as the second argument to time extraction functions: \n\n \"America/Los_Angeles\", or \"-08:00\". (\"PST\" is not supported)\n \"America/New_York\", or \"-05:00\". (\"EST\" is not supported)\n \"Europe/London\"\n \"UTC\"\n \"GMT\"\n\n#### Param data types\n\n`INT`, `STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, the `time_zone` argument is omitted, so it defaults to \"GMT\". \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_date($ts) = \"2024-02-19\"\n\n##### Example 2\n\nThis example uses a string literal to define the `time_zone`. \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_date($ts, \"America/Los_Angeles\") = \"2024-02-20\""]]
