timestamp stage is an action stage that can change the timestamp of a log
line before it is sent to Loki. When a
timestamp stage is not present, the
timestamp of a log line defaults to the time when the log entry is scraped.
timestamp: # Name from extracted data to use for the timestamp. source: <string> # Determines how to parse the time string. Can use # pre-defined formats by name: [ANSIC UnixDate RubyDate RFC822 # RFC822Z RFC850 RFC1123 RFC1123Z RFC3339 RFC3339Nano Unix # UnixMs UnixUs UnixNs]. format: <string> # Fallback formats to try if the format fails to parse the value # Can use pre-defined formats by name: [ANSIC UnixDate RubyDate RFC822 # RFC822Z RFC850 RFC1123 RFC1123Z RFC3339 RFC3339Nano Unix # UnixMs UnixUs UnixNs]. [fallback_formats: <string>] # IANA Timezone Database string. [location: <string>] # Which action should be taken in case the timestamp can't # be extracted or parsed. Valid values are: [skip, fudge]. # Defaults to "fudge". [action_on_failure: <string>]
format field can be how the reference time, defined to be
Mon Jan 2 15:04:05 -0700 MST 2006, would be interpreted in the format or can alternatviely be one of the following common forms:
Mon Jan _2 15:04:05 2006
Mon Jan _2 15:04:05 MST 2006
Mon Jan 02 15:04:05 -0700 2006
02 Jan 06 15:04 MST
02 Jan 06 15:04 -0700
Monday, 02-Jan-06 15:04:05 MST
Mon, 02 Jan 2006 15:04:05 MST
Mon, 02 Jan 2006 15:04:05 -0700
Additionally, support for common Unix timestamps is supported with the following
1562708916or with fractions
Custom formats are passed directly to the layout parameter in Go’s time.Parse function. If the custom format has no year component specified, Promtail will assume that the current year according to the system’s clock should be used.
The syntax used by the custom format defines the reference date and time using
specific values for each component of the timestamp (i.e.,
Mon Jan 2 15:04:05 -0700 MST 2006). The following table shows supported reference values which
should be used in the custom format.
|Timestamp component||Format value|
|Day of the week||
|Fraction of second||
Action on Failure
action_on_failure setting defines which action should be taken by the
stage in case the
source field doesn’t exist in the extracted data or the
timestamp parsing fails. The supported actions are:
fudge(default): change the timestamp to the last known timestamp, summing up 1 nanosecond (to guarantee log entries ordering)
skip: do not change the timestamp and keep the time when the log entry has been scraped by Promtail
- timestamp: source: time format: RFC3339Nano
This stage looks for a
time field in the extracted map and reads its value in
RFC3339Nano form (e.g.,
2006-01-02T15:04:05.999999999-07:00). The resulting
time value will be used as the timestamp sent with the log line to Loki.
Related Loki video resources
Logging with Loki: Essential configuration settings
This webinar focuses on Loki configuration, picking up where we left off at the end of the Intro to Loki webinar.