From 3c3d88c6818e34b110bf5557da45d7254acbebf6 Mon Sep 17 00:00:00 2001 From: JSCU-CNI <121175071+JSCU-CNI@users.noreply.github.com> Date: Tue, 12 May 2026 14:43:54 +0200 Subject: [PATCH] Add ISO 8601 string timestamp detection to fieldtypes --- flow/record/fieldtypes/__init__.py | 3 +++ tests/fieldtypes/test_fieldtypes.py | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/flow/record/fieldtypes/__init__.py b/flow/record/fieldtypes/__init__.py index 80cc89af..930cd32e 100644 --- a/flow/record/fieldtypes/__init__.py +++ b/flow/record/fieldtypes/__init__.py @@ -29,6 +29,7 @@ RE_NORMALIZE_PATH = re.compile(r"[\\/]+") RE_WINDOWS_PATH = re.compile(r"^[a-zA-Z]:[\\/]") +RE_ISO8601_DATETIME = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?(Z|[\+-]\d{2}:\d{2})$") UTC = timezone.utc @@ -110,6 +111,8 @@ def fieldtype_for_value(value: object, default: str = "string") -> str: if isinstance(value, _bytes): return "bytes" if isinstance(value, str): + if RE_ISO8601_DATETIME.match(value): + return "datetime" return "string" if isinstance(value, _float): return "float" diff --git a/tests/fieldtypes/test_fieldtypes.py b/tests/fieldtypes/test_fieldtypes.py index 46e9a392..c0bd14f7 100644 --- a/tests/fieldtypes/test_fieldtypes.py +++ b/tests/fieldtypes/test_fieldtypes.py @@ -813,6 +813,11 @@ def test_fieldtype_for_value() -> None: assert fieldtype_for_value(b"\r\n") == "bytes" assert fieldtype_for_value("hello world") == "string" assert fieldtype_for_value(datetime.now()) == "datetime" # noqa: DTZ005 + assert fieldtype_for_value("2026-03-19T14:20:23+00:00") == "datetime" + assert fieldtype_for_value("2026-03-19T14:20:23-01:00") == "datetime" + assert fieldtype_for_value("2026-03-19T14:20:23Z") == "datetime" + assert fieldtype_for_value("2026-03-19T14:20:23.123Z") == "datetime" + assert fieldtype_for_value("2026-03-19T14:20:23.123+01:00") == "datetime" assert fieldtype_for_value([1, 2, 3, 4, 5]) == "string" assert fieldtype_for_value([1, 2, 3, 4, 5], None) is None assert fieldtype_for_value(object(), None) is None