[pkg/ottl] Support the expression of "time of day"

[gracework]

Component(s)

pkg/ottl

Is your feature request related to a problem? Please describe.

We have OTel Collectors running in a development environment that send traces to an o11y vendor. Overnight, some processes run that generates spans that we don't need and no one ever looks at -- more than the daytime span volume.

Describe the solution you'd like

I would like to drop all telemetry during certain hours of the day / night.

This is a job for the filterprocessor, but I can't figure out how to compare a span's start_time or end_time with a specific time of day. The OTTL functions related to time are for time.Duration.

Describe alternatives you've considered

• Is there a way to create a time.Time object (such as with Now()) and then edit it to a particular time, instead of editing by time.Duration? Now() seems useful here because it can create a starting point for "today"
• Is there a way to convert a time.Time to a string? Then I could regex, substring, or edit it and then convert it from a string back to a time.Time to compare it against start_time or end_time

Additional context

If anyone has any ideas on how to accomplish this task with the existing OTTL, I would sure appreciate it 😃

[github-actions]

Pinging code owners:

• pkg/ottl: @TylerHelmuth @kentquirk @bogdandrutu @evan-bradley

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[TylerHelmuth]

@gracework if we had a function like Hour that took a time.Time and returned the hour, would that work? It would be essentially the same as https://pkg.go.dev/time#Time.Hour. You could do:

Hour(start_time) > 22 and Hour(start_time) < 5

[gracework]

@TylerHelmuth sure, I think that sounds functional! I'll probably have to do a bit of testing to confirm the correct hour (because timezones), but when is that not the case? :)

[graphaelli]

Would something like

(UnixSeconds(TruncateTime(Now(), Duration("1h"))) - UnixSeconds(TruncateTime(Now(), Duration("24h")))) / 3600)

work here @gracework ?

[TylerHelmuth]

(UnixSeconds(TruncateTime(Now(), Duration("1h"))) - UnixSeconds(TruncateTime(Now(), Duration("24h")))) / 3600)

If that works, it is a good argument to have this function haha

[graphaelli]

That's fair! I can take take this one