This topic describes the time formats that you can use for logs.

Each log entry includes a timestamp. Logtail extracts the timestamp string from the log entry and parses the string into a timestamp during log collection. Therefore, we recommend that you specify the time format for the log entry.

In Linux, Logtail supports all time formats that are defined by the strftime function. If the timestamp string of a log entry can be represented in one of the supported formats, the timestamp string can be parsed and used by Logtail.
Note
  • The timestamp of a log entry is accurate to seconds. Therefore, you can specify the time format only to seconds.
  • You only need to configure the time field.

Commonly used time formats

The following table lists the commonly used time formats that Logtail supports.
Format Description Example
%a The abbreviated day name. Fri
%A The full day name. Friday
%b The abbreviated month name. Jan
%B The full month name. January
%d The day of a month as a number. Valid values: 01 to 31. 07, 31
%h The abbreviated month name. The format is the same as the %b format. Jan
%H The hour in the 24-hour clock. 22
%I The hour in the 12-hour clock. 11
%m The month as a number. Valid values: 01 to 12. 08
%M The minute. Valid values: 00 to 59. 59
%n The line break character. A line break
%p The abbreviation that indicates the morning or afternoon. Valid values: AM and PM. AM or PM
%r The time in the 12-hour format. The format is equivalent to %I:%M:%S %p. 11:59:59 AM
%R The time expressed in hours and minutes. The format is equivalent to %H:%M. 23:59
%S The second. Valid values: 00 to 59. 59
%t The tab character. Tab
%y The two-digit year number. Valid values: 00 to 99. 04 or 98
%Y The four-digit year number. 2004 or 1998
%C The two-digit century number. Valid values: 00 to 99. 16
%e The day of a month. Valid values: 1 to 31. Prefix a space to a single-digit number. 7 or 31
%j The day of a year. Valid values: 001 to 366. 365
%u The day of a week as a number. Valid values: 1 to 7. The 1 number indicates Monday. 2
%U The week of a year. Sunday is the first day of each week. Valid value: 00 to 53. 23
%V The week of a year. Monday is the first day of each week. Valid values: 01 to 53.

If a week has four or more days that start from January 1, the week is the first week of a year. Otherwise, the next week is the first week of a year.

24
%w The day of a week as a number. Valid values: 0 to 6. The 0 number indicates Sunday. 5
%W The week of a year. Monday is the first day of each week. The Valid values: 00 to 53. 23
%c The ISO 8601 standard time. N/A
%x The ISO 8601 standard time. N/A
%X The ISO 8601 standard time. N/A
%s The Unix timestamp. 1476187251

Examples

The following table lists commonly used log time formats, and provides corresponding examples and time expressions.

Example Time expression Log time format
2017-12-11 15:05:07 %Y-%m-%d %H:%M:%S Custom
[2017-12-11 15:05:07.012] [%Y-%m-%d %H:%M:%S Custom
02 Jan 06 15:04 MST %d %b %y %H:%M RFC822
02 Jan 06 15:04 -0700 %d %b %y %H:%M RFC822Z
Monday, 02-Jan-06 15:04:05 MST %A, %d-%b-%y %H:%M:%S RFC850
Mon, 02 Jan 2006 15:04:05 MST %A, %d %b %y %H:%M:%S RFC1123
2006-01-02T15:04:05Z07:00 %Y-%m-%dT%H:%M:%S RFC3339
2006-01-02T15:04:05.999999999Z07:00 %Y-%m-%dT%H:%M:%S RFC3339Nano