When you use Logtail to collect logs, you must specify time formats based on the time strings of raw logs. Logtail extracts a time string from a raw log entry and parses the string into a UNIX timestamp. This topic describes common time formats and provides related examples.
Commonly used time formats of logs
- The timestamp of a log entry in Log Service is accurate to seconds. Therefore, you can specify the time format only to seconds.
- You only need to specify the time format for the time in a time string. Other parameters such as the time zone are not required.
- In Linux, Logtail supports all time formats provided by the strftime function. All log time strings that can be formatted by using the strftime function can be parsed and used by Logtail.
|%a||The abbreviated day name.||Fri|
|%A||The full day name.||Friday|
|%b||The abbreviated month name.||Jan|
|%B||The full month name.||January|
|%d||The day of a month. Valid values: 01 to 31.||07, 31|
|%h||The abbreviated month name. The format is equivalent to %b.||Jan|
|%H||The hour in the 24-hour clock.||22|
|%I||The hour in the 12-hour clock.||11|
|%m||The month. Valid values: 01 to 12.||08|
|%M||The minute. Valid values: 00 to 59.||59|
|%n||The line break.||A line break|
|%p||The abbreviation that indicates the morning or afternoon. Valid values: AM and PM.||AM or PM|
|%r||The time in the 12-hour format. The format is equivalent to %I:%M:%S %p.||11:59:59 AM|
|%R||The time expressed in hours and minutes. The format is equivalent to %H:%M.||23:59|
|%S||The second. Valid values: 00 to 59.||59|
|%t||The tab character.||N/A|
|%y||The two-digit year number. Valid values: 00 to 99.||04 or 98|
|%Y||The four-digit year number.||2004 or 1998|
|%C||The two-digit century number. Valid values: 00 to 99.||16|
|%e||The day of a month. Valid values: 1 to 31.
Prefix a space to a single-digit number.
|7 or 31|
|%j||The day of a year. Valid values: 001 to 366.||365|
|%u||The day of a week as a number. Valid values: 1 to 7. The value 1 indicates Monday.||2|
|%U||The week of a year. Sunday is the first day of each week. Valid values: 00 to 53.||23|
|%V||The week of a year. Monday is the first day of each week. Valid values: 01 to 53.
If a week that contains January 1 has four or more January days, the week is the first week of a year. Otherwise, the next week is considered the first week of a year.
|%w||The day of a week as a number. Valid values: 0 to 6. The value 0 indicates Sunday.||5|
|%W||The week of a year. Monday is the first day of each week. Valid values: 00 to 53.||23|
|%c||The date and time in the ISO 8601 format.||Tue Nov 20 14:12:58 2020|
|%x||The date in the ISO 8601 format.||Tue Nov 20 2020|
|%X||The time in the ISO 8601 format.||11:59:59|
|%s||The UNIX timestamp.||1476187251|
The following table lists commonly used time formats. It also provides related examples and time expressions.
|Example||Time expression||Time format|
|2017-12-11 15:05:07||%Y-%m-%d %H:%M:%S||Custom|
|[2017-12-11 15:05:07.012]||[%Y-%m-%d %H:%M:%S]||Custom|
|02 Jan 06 15:04 MST||%d %b %y %H:%M||RFC822|
|02 Jan 06 15:04 -0700||%d %b %y %H:%M||RFC822Z|
|Monday, 02-Jan-06 15:04:05 MST||%A, %d-%b-%y %H:%M:%S||RFC850|
|Mon, 02 Jan 2006 15:04:05 MST||%A, %d %b %Y %H:%M:%S||RFC1123|