Subtracting timestamps in VRL

[Maixy]

Hi all!

Is it possible to perform timestamp math in VRL?

If I've got an event that looks like { message: "foo", timestamp: 2025-02-03T17:42:24.630761338Z } is there a way to perform math similar to now() - .timestamp and convert the result to a float?

[Maixy]

I think part of the problem I'm running into is that the parse_timestamp() method seems to inconsistently parse values:

https://playground.vrl.dev/?state=eyJwcm9ncmFtIjoiXG4ubm93ID0gbm93KClcbi5wYXJzZWRfdHMgPSBwYXJzZV90aW1lc3RhbXAhKC50cywgXCIlWS0lbS0lZFQlSDolTTolUy4lZlpcIilcbi5wYXJzZWRfbm93ID0gcGFyc2VfdGltZXN0YW1wISgubm93LCBcIiVZLSVtLSVkVCVIOiVNOiVTLiVmWlwiKSIsImV2ZW50Ijp7InRzIjoiMjAyNS0wMi0wM1QxOTozMzo1OC43NTZaIn0sImlzX2pzb25sIjpmYWxzZSwiZXJyb3IiOm51bGx9

In this example we can see that the timestamp produced from now() is parsed correctly, but the one passed in from the event (which is just a copy&paste of the now() output) somehow generates a time value far in the future.

Am I missing a parsing step?

[Maixy]

Solved!

I had a couple different issues going on.
The first one was that I was running vector v0.42.0 locally, which didn't have support for the timezone parameter in parse_timestamp(). It seemed like the VRL library would automatically just detect the timezone of the host when doing calculations, but was inconsistent about that when using a VRL generated timestamp like now().

After upgrading to v.0.44 I've been able to pass in the correct TZ data as a third parameter:

parsed_ts = parse_timestamp!(.ts,      "%Y-%m-%dT%H:%M:%S.%fZ", "UTC")
parsed_now = parse_timestamp!(now(),    "%Y-%m-%dT%H:%M:%S.%fZ", "UTC")
.delta_in_seconds = to_float(parsed_now) - to_float(parsed_ts)

https://playground.vrl.dev/?state=eyJwcm9ncmFtIjoiXG5wYXJzZWRfdHMgPSBwYXJzZV90aW1lc3RhbXAhKC50cywgICAgICBcIiVZLSVtLSVkVCVIOiVNOiVTLiVmWlwiLCBcIlVUQ1wiKVxucGFyc2VkX25vdyA9IHBhcnNlX3RpbWVzdGFtcCEobm93KCksICAgIFwiJVktJW0tJWRUJUg6JU06JVMuJWZaXCIsIFwiVVRDXCIpXG4uZGVsdGFfaW5fc2Vjb25kcyA9IHRvX2Zsb2F0KHBhcnNlZF9ub3cpIC0gdG9fZmxvYXQocGFyc2VkX3RzKSIsImV2ZW50Ijp7InRzIjoiMjAyNS0wMi0wM1QxOTozMzo1OC43NTZaIn0sImlzX2pzb25sIjpmYWxzZSwiZXJyb3IiOm51bGx9