This is documentation for the next version of Enterprise logs. For the latest stable release, go to the latest version.
timestamp stage is an action stage that can change the timestamp of a log
line before it is sent to Loki. When a
timestamp stage is not present, the
timestamp of a log line defaults to the time when the log entry is scraped.
timestamp: # Name from extracted data to use for the timestamp. source: <string> # Determines how to parse the time string. Can use # pre-defined formats by name: [ANSIC UnixDate RubyDate RFC822 # RFC822Z RFC850 RFC1123 RFC1123Z RFC3339 RFC3339Nano Unix # UnixMs UnixUs UnixNs]. format: <string> # Fallback formats to try if the format fails to parse the value # Can use pre-defined formats by name: [ANSIC UnixDate RubyDate RFC822 # RFC822Z RFC850 RFC1123 RFC1123Z RFC3339 RFC3339Nano Unix # UnixMs UnixUs UnixNs]. [fallback_formats: <string>] # IANA Timezone Database string. [location: <string>] # Which action should be taken in case the timestamp can't # be extracted or parsed. Valid values are: [skip, fudge]. # Defaults to "fudge". [action_on_failure: <string>]
format field can be how the reference time, defined to be
Mon Jan 2 15:04:05 -0700 MST 2006, would be interpreted in the format or can alternatviely be one of the following common forms:
Mon Jan _2 15:04:05 2006
Mon Jan _2 15:04:05 MST 2006
Mon Jan 02 15:04:05 -0700 2006
02 Jan 06 15:04 MST
02 Jan 06 15:04 -0700
Monday, 02-Jan-06 15:04:05 MST
Mon, 02 Jan 2006 15:04:05 MST
Mon, 02 Jan 2006 15:04:05 -0700
Additionally, support for common Unix timestamps is supported with the following
1562708916or with fractions
Custom formats are passed directly to the layout parameter in Go’s time.Parse function. If the custom format has no year component specified, Promtail will assume that the current year according to the system’s clock should be used.
The syntax used by the custom format defines the reference date and time using
specific values for each component of the timestamp (i.e.,
Mon Jan 2 15:04:05 -0700 MST 2006). The following table shows supported reference values which
should be used in the custom format.
|Timestamp component||Format value|
|Day of the week|
|Fraction of second|
Action on Failure
action_on_failure setting defines which action should be taken by the
stage in case the
source field doesn’t exist in the extracted data or the
timestamp parsing fails. The supported actions are:
fudge(default): change the timestamp to the last known timestamp, summing up 1 nanosecond (to guarantee log entries ordering)
skip: do not change the timestamp and keep the time when the log entry has been scraped by Promtail
- timestamp: source: time format: RFC3339Nano
This stage looks for a
time field in the extracted map and reads its value in
RFC3339Nano form (e.g.,
2006-01-02T15:04:05.999999999-07:00). The resulting
time value will be used as the timestamp sent with the log line to Loki.
Related Enterprise Logs resources
Grafana Enterprise Logs: Logging with security and scale
Join us for this webinar, which will cover: Challenges with logging as organizations scale and the volume of logs explodes, how Grafana Enterprise Logs enables organizations to make logs available to any team members who need them, features available in GEL and how to get access, a live product demo so you can see GEL for the first time
VIDEO: Watch this first-look demo of the new Grafana Enterprise Logs
Based on Loki, Grafana Enterprise Logs is part of the Grafana Enterprise Stack for composing and scaling observability on your own infrastructure.
Introducing Grafana Enterprise Logs, a core part of the Grafana Enterprise Stack integrated observability solution
Powered by the Loki open source project, the Enterprise Logs offering joins metrics and dashboards in our enterprise-ready stack for self-managed observability.