Add time() function for querying timestamp

[LuminatiHD]

Is your feature request related to a problem? Please describe. I have oftentimes encountered problems which would be solved by being able to use a function which would return the current time/date/timestamp, similar to prometheus' time() function. As an illustrative example, imagine a script which every day logs the timestamp it ran at, and I wanted to write a rule that would check this timestamp to ensure that it does in fact run everyday. In PromQL, this would look something like: (time() - my_script{output='timestamp'})/3600 < 24 However, I have found no functionality in LogQL which could do something similar. Describe the solution you'd like As mentioned, I'd like LogQL to have a function like time() in PromQL.

Describe alternatives you've considered I have tried a few things with __timestamp__, but that function seems to be built only for templating and not log/metric querying. Or maybe I am doing something wrong.

[Amoolaa]

+1, desperately need this. Allows us to alert on whether logs from a particular stream have appeared in the last x mins, which can't be done currently with absent_over_time (since that drops all labels)

[MarcSollie]

+1, really need this as well. Have been searching for an hour for something like this, because I couldn't believe it didn't exist.

[tonyswu]

Stumbled upon this request by a community forum post. Just want to mention that this can be done, sort of, by using sub and unixEpoch. You can then assign the value to a label, then perform other calculations from there.

For example, to calculate elapsed time from a log line to current time:

sub (unixEpoch now) (unixEpoch __timestamp__)

And to assign that to a label:

{SELECTOR}
  | label_format elapsed=`{{ sub (unixEpoch now) (unixEpoch __timestamp__) }}`