@@ -164,6 +164,7 @@ def generate_rules_index(
164164@click .option ("--strip-none-values" , "-snv" , is_flag = True , help = "Strip None values from the rule" )
165165@click .option ("--local-creation-date" , "-lc" , is_flag = True , help = "Preserve the local creation date of the rule" )
166166@click .option ("--local-updated-date" , "-lu" , is_flag = True , help = "Preserve the local updated date of the rule" )
167+ @click .option ("--dates-import" , "-di" , is_flag = True , help = "Parse created_at and updated_at from the rule content" )
167168@click .option (
168169 "--load-rule-loading" ,
169170 "-lr" ,
@@ -184,11 +185,16 @@ def import_rules_into_repo( # noqa: PLR0912, PLR0913, PLR0915
184185 strip_none_values : bool ,
185186 local_creation_date : bool ,
186187 local_updated_date : bool ,
188+ dates_import : bool ,
187189 load_rule_loading : bool ,
188190) -> None :
189191 """Import rules from json, toml, or yaml files containing Kibana exported rule(s)."""
190192 errors : list [str ] = []
191193
194+ if dates_import and (local_creation_date or local_updated_date ):
195+ click .echo ("Error: --dates-import cannot be used with --local-creation-date or --local-updated-date." )
196+ return
197+
192198 rule_files : list [Path ] = []
193199 if directory :
194200 rule_files = list (directory .glob ("**/*.*" ))
@@ -248,13 +254,14 @@ def import_rules_into_repo( # noqa: PLR0912, PLR0913, PLR0915
248254 contents ["author" ] = [contents ["author" ]]
249255
250256 # Parse created_at and updated_at to creation_date and updated_date if they exist in contents
251- now = datetime .now (UTC ).strftime ("%Y-%m-%dT%H:%M:%S.%fZ" )
252- contents ["creation_date" ] = datetime .strptime (
253- contents .get ("created_at" , now ), "%Y-%m-%dT%H:%M:%S.%fZ"
254- ).strftime ("%Y/%m/%d" )
255- contents ["updated_date" ] = datetime .strptime (contents .get ("updated_at" , now ), "%Y-%m-%dT%H:%M:%S.%fZ" ).strftime (
256- "%Y/%m/%d"
257- )
257+ if dates_import :
258+ now = datetime .now (UTC ).strftime ("%Y-%m-%dT%H:%M:%S.%fZ" )
259+ contents ["creation_date" ] = datetime .strptime (
260+ contents .get ("created_at" , now ), "%Y-%m-%dT%H:%M:%S.%fZ"
261+ ).strftime ("%Y/%m/%d" )
262+ contents ["updated_date" ] = datetime .strptime (
263+ contents .get ("updated_at" , now ), "%Y-%m-%dT%H:%M:%S.%fZ"
264+ ).strftime ("%Y/%m/%d" )
258265
259266 contents .update (
260267 update_metadata_from_file (
0 commit comments