Promtail: Timestamp not parsed properly into Loki and Grafana

user_16331797 0
Viewed 2335

Currently, I am looking to process logs in json format.

I have managed to convert the given timestamp into a RFC3339 format. However, when parsing it through Promtail, it appears to be parsed but not being used as the displayed timestamp. Rather, it is using the timestamp where Promtail pushed said log to Loki.

Below is the snippet of my Promtail configuration:

scrape_configs:
- job_name: Test
  static_configs:
  - targets:
      - localhost
    labels:
      job: Testing2
      __path__: /path/to/*.json

  pipeline_stages:
  - json:
      expressions:
        timestamp: timestamp
  - timestamp:
      source: timestamp
      format: 2006-01-02T15:04:05Z07:00

I have also tried switching the timestamp format to RFC3339 to no results as well.

Below is a sample log I generated

{"id":5072,"type":0,"timestamp":"2021-06-28T03:00:05+08:00","user":"System","ip":"127.0.0.1","computer":"localhost","desc":"Dummy message"}

This is how the log appears in Grafana. The timestamp field and ts field (which is used for displaying in Grafana) is different. Sample Log as shown in Grafana

I would greatly appreciate any help or direction towards debugging. Do let me know if there are any additional information required!

grafana-loki grafana
1 Answers

I suggest you change the name of the field from timestamp to time: Also the format of timestamp looks wrong, different from the log you generated:

"timestamp":

  • 2006-01-02T15:04:05Z07:00

log format:

  • "2021-06-28T03:00:05+08:00"

You should put the correct format in the config

pipeline_stages:
  - json:
      expressions:
        time: timestamp
  - timestamp:
      source: time
      format: 2006-01-02T15:04:05-07:00

you can also try 03 instead of 15:

  • 2006-01-02T03:04:05-07:00
user_124685650
Related