Skip to main content
Solved

REST Collector API Call Failing With: Parameter "beginTime" Format Error

  • January 31, 2026
  • 3 replies
  • 1 view
C
This message originated from Cribl Community Slack.
Click here to view the original link.

Hey ya'll! REST Collector question - API call to PingID endpoint /monitoring/logs to retrieve events. I'm having some trouble with the stored state being formatted as the API is expecting. parameter: beginTime = C.Time.strftime((state.latestTime+.001).toPrecision(13), "%Y-%m-%dT%H:%M:%S.%f") response: {"code":400,"message":"parameter \"beginTime\" in query has an error: string doesn't match the format \"date-time\": string doesn't match pattern \"^[0-9]{4}-(0[1-9]|10|11|12)-(0[1-9]|[12][0-9]|3[01])T([0-1][0-9]|2[0-3]):[0-5][0-9]:([0-5][0-9]|60)(\\.[0-9]+)?(Z|(\\+|-)[0-9]{2}:[0-9]{2})?$\""}

Best answer by edix603

Hello, there are a few ways to get your state timestamp into ISO 8601 datetime format. One way that worked for me was to create a Date object with the state value and use the .toISOString() method on the object instance you create. The Date constructor takes a Unix timestamp in milliseconds, so you have to convert state.latestTime to this format because Cribl stores the value as a Unix timestamp in seconds. Make sure to use a template literal as well within the REST collector source JavaScript expression fields. Let me know if you continue to have any issues. 
(new Date(state.latestTime * 1000)).toISOString()
Or you can try to adjust your formatting and keep things similar to what you are doing now. 
C.Time.strftime(state.latestTime, "%Y-%m-%dT%H:%M:%S.%LZ")

3 replies

C


Links for this message:
image.png
E
  • edix603
  • New Participant
  • Answer
  • January 31, 2026
Hello, there are a few ways to get your state timestamp into ISO 8601 datetime format. One way that worked for me was to create a Date object with the state value and use the .toISOString() method on the object instance you create. The Date constructor takes a Unix timestamp in milliseconds, so you have to convert state.latestTime to this format because Cribl stores the value as a Unix timestamp in seconds. Make sure to use a template literal as well within the REST collector source JavaScript expression fields. Let me know if you continue to have any issues. 
(new Date(state.latestTime * 1000)).toISOString()
Or you can try to adjust your formatting and keep things similar to what you are doing now. 
C.Time.strftime(state.latestTime, "%Y-%m-%dT%H:%M:%S.%LZ")
C
@user I cannot thank you enough, the toISOString was the missing piece. That format you shared was accepted by the Forgerock API and I started getting accurate audit logs in to Cribl. Thanks again! :happygoat:
Terms & ConditionsAccessibility statement