Normalize and reposition Apache timestamps

Convert bracketed UTC+1 log timestamps to ISO-like UTC and move them to the start of each record.

Install in Serialize

What it can do

Process multi-line logs
Edit only a timestamp subsection
Convert from UTC+1 to UTC
Move normalized time to the leading column

How the recipe works

Fork

Process each log record independently.

Subsection

Select the bracketed UTC+1 timestamp.

Find / Replace

Remove the brackets inside the selected region.

Translate DateTime Format

Translate the source format and zone to UTC.

Merge

Reassemble the full record.

Fork

Process each normalized record again.

Capture prefix, timestamp, and suffix.

Find / Replace

Reorder the captured fields.

Demonstration

Sample input

203.0.113.8 - - [20/Sep/2026:10:15:30 +0100] "GET /health HTTP/1.1" 200 18

Expected result

2026-09-20T09:15:30 +0000

When to use it

Cross-system timeline correlation
Preparing sortable logs
Advanced workflow-control lessons

Adapt it

Change both the numeric-offset matcher and the source time zone when logs come from another region.

Source and verification

Adapted from mattnotmax CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.