Function

Description

Example > Output

now, date

now returns the current timestamp, while date converts a timestamp into a format of choice

{{ now }} > 2025-10-08 06:31:32.77852745 +0000 UTC m=+46492.668241387
Golang format: {{ now | date "2006-01-02" }} > 2025-10-08
RFC850: {{ now | date "Monday, 02-Jan-06 15:04:05 MST" }} > Wednesday, 08-Oct-25 06:31:32 UTC
RFC3399: {{ now | date "2006-01-02T15:04:05Z07:00" }} >
​2025-10-08T06:31:32Z

unixEpoch

Returns the Unix timestamp (seconds since January 1 1970 UTC) for a given date or for the current time

{{ unixEpoch now }} > 1759905092

ago

Calculates how much time has passed since the provided timestamp and returns a human-readable duration

{{ toDate "2006-01-02T15:04:05Z" "2025-10-04T15:30:00Z" | ago }} > 87h1m33s

toDate

Parses a date string and converts it into a timestamp object that other time functions can use

{{ toDate "2006-01-02T15:04:05Z" "2025-10-04T15:30:00Z" | date "Monday Jan 2 2006" }} > Saturday Oct 4 2025

date_in_zone

Converts a timestamp into a specific timezone, useful for aligning logs or reports

{{ date_in_zone "2006-01-02T15:04:05Z" (now) "America/Chicago" }} > 2025-10-08T01:31:32Z

date_modify

Adds or subtracts a duration (like hours, days, or minutes) from a given date or timestamp

{{ now | date_modify "-2h" | date "2006-01-02T15:04:05Z" }} >
​2025-10-08T04:31:32Z
​{{ date_modify "24h" ( toDate "2006-01-02" "2025-10-01") }} >
​2025-10-02 00:00:00 +0000 UTC
​{{ now | date_modify "24h" | date "2006-01-02T15:04:05Z" }} >
​2025-10-09T06:31:32Z

duration

Converts a duration string into a precise duration value usable in time calculations

{{ duration "7199" }} > 1h59m59s

durationRound

Rounds a duration to the nearest unit (e.g., minute, hour, day) for cleaner output or scheduling precision

{{ durationRound "2h10m5s" }} > 2h

now.Unix

Returns the current time as a Unix timestamp (seconds since Jan 1, 1970)

{{ now.Unix }} > 1759905092

now.UnixMilli, now.UnixMicro, now.UnixNano

Returns the current time as a Unix timestamp in milliseconds, microseconds, or nanoseconds

{{ now.UnixMilli }} > 1759905092970
​{{ now.UnixMicro }} > 1759905092970754
​{{ now.UnixNano }} > 1759905092970934405

now.Year, now.Day

Returns the current year or the current day of the month as an integer

{{ now.Year }} > 2025
​{{ now.Day }} > 8

now.Month, now.Weekday

Returns the current month or the current day of the week as a string

{{ now.Month }} > October
​{{ now.Weekday }} > Wednesday

Function

Example

Year

"2006", "06"

Month

"Jan", "January", "01", "1"

Day of the week

"Mon", "Monday"

Day of the month

"2", "_2", "02"

Day of the year

"__2", "002"

Hour

"15", "3", "03" (PM or AM)

Minute

"4", "04"

Second

"5", "05"

AM/PM mark

"PM"

Function

Example

Layout

"01/02 03:04:05PM '06 -0700" (The reference time, in numerical order)

ANSIC

"Mon Jan _2 15:04:05 2006"

UnixDate

"Mon Jan _2 15:04:05 MST 2006"

RubyDate

"Mon Jan 02 15:04:05 -0700 2006"

RFC822

"02 Jan 06 15:04 MST"

RFC822Z

"02 Jan 06 15:04 -0700" (RFC822 with numeric zone)

RFC850

"Monday, 02-Jan-06 15:04:05 MST"

RFC1123

"Mon, 02 Jan 2006 15:04:05 MST"

RFC1123Z

"Mon, 02 Jan 2006 15:04:05 -0700" (RFC1123 with numeric zone)

RFC3339

"2006-01-02T15:04:05Z07:00"

RFC3339Nano

"2006-01-02T15:04:05.999999999Z07:00"

Kitchen

"3:04PM"

Function

Example

Stamp

"Jan _2 15:04:05"

StampMilli

"Jan _2 15:04:05.000"

StampMicro

"Jan _2 15:04:05.000000"

StampNano

"Jan _2 15:04:05.000000000"

DateTime

"2006-01-02 15:04:05"

DateOnly

"2006-01-02"

TimeOnly

"15:04:05"

Function

Description

Example > Output

b64enc, b64dec

Encodes or decodes the provided data using Base64 encoding

{{ b64enc "hello world" }} > aGVsbG8gd29ybGQ=
{{ b64dec "aGVsbG8gd29ybGQ=" }} > hello world

Function

Description

Example > Output

default

If the evaluated value is empty, the given default will be returned

{{ default "N/A" $.user.email }} > N/A (if user email is missing) or john.doe@mail.com (if this email exists)

Function

Description

Example > Output

ternary

Takes two values and a third test value. If the test value is true, the first of the two values will be returned. If the test value is empty, the second of the two values will be returned.

{{ ternary "High" "Low" (gt $.alert.severity 7) }} > "High" (if the severity > 7)

empty

Returns true if value is empty, and false otherwise

{{ empty $.event.user_email }} > true (if user_email is missing)

Function

Description

Example > Output

jsonEscape

Escapes a string so it can be safely embedded in JSON (adds backslashes for quotes, newlines, etc.)

{{ jsonEscape Obi Wan said, "Hello there!" }} > Obi Wan said, \"Hello there"\"

toJson

Converts a data structure (e.g., map, list, dict) into a JSON string. Useful for serializing data for API requests or logs.

{{ toJson (dict "user" "alice" "role" "admin" "active" true) }} > {"active":true,"role":"admin","user":"alice"}

toPrettyJson

Converts a data structure (e.g., map, list, dict) into an indented, human-readable JSON format for easier viewing

{{ toPrettyJson (dict "user" "alice" "role" "admin" "active" true) }} >
​{
"user": "alice",
"role": "admin",
"active": true
}

toRawJson

Similar to toJson, but does not escape special characters, preserving the original formatting. Typically used when passing JSON payloads to APIs that require raw JSON input.

{{ toRawJson (dict "user" "alice" "role" "admin" "active" true) }} > {"user":"alice","role":"admin","active":true}

int, toString

Converts the provided data to an integer or to a string

{{ int "42" }} > 42
​{{ toString 42 }} > "42"

toStrings

Converts each element of a list to a string

{{ toStrings (list 1 true "alert") }} > ["1","true","alert"]

Function

Description

Example > Output

join

Joins elements of an array or list into a single string, using the given separator

{{ join "," $.set_variable_array_of_strings.json }} > "malware,phishing,ransomware” if $.set_variable_array_of_strings.json = (list "malware" "phishing" "ransomware")

split

Splits a string into a list of substrings based on a separator

{{ split "," "malware,phishing,ransomware" }} >
​{
"_0": "malware",
"_1": "phishing",
"_2": "ransomware"
}

splitList

Splits a string or list into smaller lists using a separator

{{ splitList "," "user1@example.com,user2@example.com,user3@example.com" | toJson }} >
​[
"user1@example.com",
"user2@example.com",
"user3@example.com"
]

splitn

Splits a string into n parts using a separator, returning only up to the specified number of splits

{{ splitn ":" 2 "user@example.com:admin" | toJson }} >
​{
"_0": "user@example.com",
"_1": "admin"
}

Function

Description

Example > Output

list

Creates a new list (array) from the provided items. Useful for grouping multiple values together.

{{ list "one" "two" "three" | toJson }} > ["one","two","three"]

rest

Returns all elements of a list except the first

{{ rest (list 1 2 3 4) | toJson }} > [2,3,4]

has

Checks whether a list or map contains a given value or key. Returns true or false.

{{ has "error" $.set_variable_array_of_strings.json }} > true

append

Adds one or more elements to the end of a list and returns the new list

{{ append $.set_variable.json 4 | toJson }} > [1,2,3],
if $.set_variable.json = [1, 2, 3]

prepend

Adds one or more elements to the beginning of a list and returns the new list

{{ prepend $.set_variable.json 0 | toJson }} > [0,1,2,3]
if $.set_variable.json = [1, 2, 3]

uniq

Removes duplicate values from a list

{{ uniq $.set_variable.json | toJson }} > [1,2,3,4],
if $.set_variable.json = [1, 2, 2, 3, 3, 3, 4]

without

Returns a list that excludes specified values

{{ without (list 1 2 3 4) 2 4 }} > [1, 3]

slice

Extracts a sub-list (slice) from the given list using start and end indexes

{{ slice $.set_variable_array_of_strings.json 1 3 | toJson }} > ["beta","gamma"],
if $.set_variable_array_of_strings.json = ["alpha", "beta", "gamma", "delta", "epsilon"]

last

Returns the last element of a list

{{ last $.set_variable_array_of_strings.json }} > "c", if
​$.set_variable_array_of_strings.json = ["a", "b", "c"]

first

Returns the first element of a list

{{ first $.set_variable_array_of_strings.json }} > "a", if
​$.set_variable_array_of_strings.json = ["a", "b", "c"]

initial

Returns all elements of a list except the last one

{{ initial $.set_variable_array_of_strings.json | toJson }} > ["1","2","3"], if $.set_variable_array_of_strings.json = ["1", "2", "3", "4"]

merge

Combines two or more maps (key-value pairs) into one. Later values overwrite earlier ones.

{{ merge (dict "a" 1 "b" 2) (dict "b" 3 "c" 4) }} > {"a": 1, "b": 3, "c": 4}

len

Returns the length of a string, array, map, or object

{{ len "Torq" }} > 4

Function

Description

Example > Output

dict

Creates a new dictionary (map) with the specified key-value pairs. Useful for grouping structured data.

{{ dict "name" "Alice" "age" 30 | toJson }} > {"name": "Alice", "age": 30}

keys

Returns a list of all keys in a dictionary

{{ keys (dict "a" 1 "b" 2 "c" 3) | toJson }} > ["a","b","c"]

values

Returns a list of all values in a dictionary

{{ values (dict "a" 1 "b" 2 "c" 3) | toJson }} > [1,2,3]

set

Adds or updates a key-value pair in an existing dictionary. Returns the updated dictionary.

{{ set (dict "a" 1) "b" 2 | toJson }} > {"a":1,"b":2}

unset

Removes a key (and its value) from a dictionary. Returns the updated dictionary

{{ unset (dict "a" 1 "b" 2) "a" | toJson }} > {"b":2}

hasKey

Checks whether a dictionary contains a specific key. Returns true or false.

{{ hasKey (dict "a" 1 "b" 2) "a" }} > true

merge

Combines two or more maps (key-value pairs) into one. Later values overwrite earlier ones.

{{ merge (dict "a" 1 "b" 2) (dict "b" 3 "c" 4) (dict "b" 5 "e" 7) | toJson }} >
​{
"a": 1,
"b": 2,
"c": 4,
"e": 7
}

Function

Description

Example > Output

trim, trimAll, trimSuffix, trimPrefix

trim removes spaces from either side of the string, whereas trimAll Removes all specified characters from the beginning and end of a string (but not from the middle). Similarly, trimSuffix and trimPrefix remove just the matching side of the string.

{{ trim " alert triggered " }} > "alert triggered"
​{{ trimAll "-" "----critical-alert----" }} > criticalalert
​{{ trimSuffix ".log" "incident_2025.log" }} > "incident_2025”
​{{ trimPrefix "user_" "user_admin" }} > "admin"

upper, lower

Converts a string to uppercase or lowercase

{{ upper "torq" }} > TORQ
​{{ lower "TORQ" }} > torq

title

Converts the first letter of each word in a string to uppercase. Useful for formatting names, titles, or headings.

{{ title "security incident summary" }} > Security Incident Summary

untitle

Converts all characters in a string to lowercase. Often used for normalization before comparison or storage.

{{ untitle "Security INCIDENT Summary" }} > security iNCIDENT summary

substr

Returns a substring from a provided string using start and end indexes

{{ substr 4 12 "TorqSecurityPlatform" }} > Security

nospace

Removes all whitespaces from a string

{{ nospace "SOC Operations Center" }} > SOCOperationsCenter

trunc

Truncates a string by keeping the first X characters

{{ trunc 5 "incidentresponse" }} > incid

hasPrefix, hasSuffix

Returns true if the given string starts with the specified prefix or ends with the specified suffix.

{{ hasPrefix "alert_" "alert_high" }} > true
​{{ hasSuffix "_high" "alert_high" }} > true

contains

Returns true if the specified substring exists anywhere within the given string

{{ contains "Malware" "Security Alert: Malware detected" }} > true

replace

Replaces all occurrences of a substring within a string

{{ replace " " "-" "SOC Alert Active" }} e.g., "aBcXyZqw" > SOC-Alert-Active

snakecase, camelcase, kebabcase

Converts strings to snake_case, camelCase, or kebab-case

{{ snakecase "Security Incident Report" }} > "security_incident_report”
​{{ camelcase "Security Incident Report" }} > "SecurityIncidentReport"
​{{ kebabcase "Security Incident Report" }} > "security-incident-report”

wrapWith

Wraps text by inserting the specified string (such as a tab or symbol) after the defined number of characters

{{ wrapWith 30 "\t" "This is a long statement using a Torq variable." }} → This is a long statement using\ta Torq variable

wrap

Wraps text by inserting a newline after the specified number of characters

{{ wrap 30 "This is a long statement using a Torq variable." }} > This is a long statement using\na Torq variable.

Function

Description

Example > Output

regexMatch

Checks whether a given string matches a regular expression pattern. Returns true or false.

{{ regexMatch "^user.*" "user123" }} > true

regexFind

Returns the first substring that matches the given regular expression pattern

{{ regexFind "[0-9]+" "User123LoggedIn" }} > 123

regexFindAll

Returns substrings that match the given regular expression pattern as an array. Use an additional numeric argument (e.g., -1) to specify how many matches to return. For example, -1 returns all matches

{{ regexFindAll "[0-9]+" "Item12Box34Shelf56" -1 }} > ["12", "34", "56"]

regexReplaceAll

Replaces all substrings that match a given regular expression with a specified replacement string

{{ regexReplaceAll "[0-9]+" "#" "User123LoggedIn" }} > User#LoggedIn

regexSplit

Splits a string into a list based on matches of a regular expression. Use an additional numeric argument (e.g., -1) to specify how many splits to perform, -1 returns all possible splits.

{{ regexSplit "[,;\\s]+" "alpha, beta; gamma delta" -1 }} > ["alpha", "beta", "gamma", "delta"]

Function

Description

Example > Output

add, sub, mul, div

Performs addition, subtraction, multiplication, or division. Requires numeric values (not strings).

{{ add 5 3 }} > 8
​{{ sub 10 4 }} > 6
​{{ mul 3 5 }} > 15
​{{ div 20 4 }} > 5

add1

Increments a numeric value by 1. Useful for counters and iterative operations.

{{ add1 4 }} > 5

mod

Returns the remainder of a division operation (modulus)

{{ mod 10 3 }} > 1

max

Returns the highest value among the provided numbers

{{ max 3 7 2 }} > 7

min

Returns the lowest value among the provided numbers

{{ min 3 7 2 }} > 2

floor

Rounds a floating-point number down to the nearest integer

{{ floor 4.9 }} > 4

ceil

Rounds a floating-point number up to the nearest integer

{{ ceil 4.1 }} > 5

round

Rounds a floating-point number to the nearest integer or to a specified precision (half values round up).

{{ round 4.5 }} > 5
​{{ round 4.494 2 }} > 4.49