BSD Syslog (RFC 3164)

datetime.timestamp.syslog_bsd

Legacy syslog format from RFC 3164. No year component — year must be inferred from context. Day is space-padded. Extremely widespread in /var/log/syslog on Linux/BSD systems.

Domain

datetime

Try it

CLI

$ finetype infer -i "Jan 15 14:30:00"
→ datetime.timestamp.syslog_bsd

DuckDB

Detect

SELECT finetype('Jan 15 14:30:00');
-- → 'datetime.timestamp.syslog_bsd'

Cast expression

strptime(CAST(YEAR(CURRENT_DATE) AS VARCHAR) || ' ' || {col}, '%Y %b %e %H:%M:%S')
-- Format: %b %e %H:%M:%S

Safe cast pipeline

-- Normalise and cast in one step
SELECT TRY_CAST(finetype_cast(my_column) AS VARCHAR) AS clean_value
FROM my_table
WHERE finetype(my_column) = 'datetime.timestamp.syslog_bsd';

JSON Schema

finetype schema datetime.timestamp.syslog_bsd

{
  "$id": "https://meridian.online/schemas/datetime.timestamp.syslog_bsd",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "description": "Legacy syslog format from RFC 3164. No year component — year must be inferred from context. Day is space-padded. Extremely widespread in /var/log/syslog on Linux/BSD systems.",
  "examples": [
    "Jan 15 14: 30: 00",
    "Dec 31 23: 59: 59",
    "Jun  1 08: 15: 30"
  ],
  "maxLength": 15,
  "minLength": 15,
  "pattern": "^[A-Z][a-z]{2} [\\s\\d]\\d \\d{2}:\\d{2}:\\d{2}$",
  "title": "BSD Syslog (RFC 3164)",
  "type": "string",
  "x-finetype-broad-type": "VARCHAR",
  "x-finetype-format-string": "%b %e %H:%M:%S",
  "x-finetype-transform": "strptime(CAST(YEAR(CURRENT_DATE) AS VARCHAR) || ' ' || {col}, '%Y %b %e %H:%M:%S')"
}

Examples

Jan 15 14:30:00Dec 31 23:59:59Jun 1 08:15:30

Aliases

rfc_3164