edit-icon download-icon

Text logs - Configure time format

Last Updated: Mar 13, 2018

As described in the core concepts of Log Service, each log in Log Service has a timestamp when this log happened. Logtail must extract the timestamp string of each log and parse it into a timestamp when collecting logs from your log files. Therefore, you must specify the timestamp format of the log for Logtail.

In Linux, Logtail supports all time formats provided by the strftime function. Logtail can parse and use the timestamp strings that can be expressed in the log formats defined by the strftime function.

In reality, the timestamp strings of logs have multiple formats. To make configuration easier, Logtail supports the following common log time formats.

FormatMeaningExample (Description)
%aThe abbreviation of a day in a week.Example: Fri
%AThe name of a day in a week.Example: Friday
%bThe abbreviation of a month.Example: Jan
%BThe name of a month.Example: January
%dThe day of the month in decimal format [01,31].Example: 07, 31
%hThe abbreviation of a month. Same as %b.Example: Jan
%HThe hour in 24-hour format. Example: 22
%IThe hour in 12-hour format.Example: 11
%mThe month in decimal format.Example: 08
%M The minute in decimal format [00,59].Example: 59
%nA line break.A line break
%pAM or PM locally. Example: AM/PM
%rTime in 12-hour format, which is equivalent to %I:%M:%S %p.Example: 11:59:59 AM
%RTime expressed in hour and minute, which is equivalent to %H:%M.Example: 23:59
%SThe second in decimal format [00,59].Example: 59
%tTab character.Tab character
%yThe year without century in decimal format [00,99].Example: 04, 98
%YThe year in decimal format.Example: 2004, 1998
%zThe time zone or its abbreviation.Example:-07:00, +0800
%CThe century in decimal format [00-99].Example: 16
%e The day of the month in decimal format [1,31]. A single digit is preceded by a space.Example: 7, 31
%jThe day of the year in decimal format [001,366].Example: 365
%uThe day of the week in decimal format [1,7]. 1 represents Monday.Example: 2
%UThe week number of the year (Sunday as the first day of the week) [00,53].Example: 23
%VThe week number of the year (Monday as the first day of the week) [01,53]. If the week at the beginning of January has no less than four days, this week is the first week of the year. Otherwise, the next week is considered as the first week of the year.Example: 24
%w The day of the week in decimal format [0,6]. 0 represents Sunday.Example: 5
%WThe week number of the year (Monday as the first day of the week) [00,53].Example: 23
%cStandard date and time representation.To specify more information such as long date and short date, we recommend that you use the preceding supported formats for more precise expression.
%xStandard date representation.To specify more information such as long date and short date, we recommend that you use the preceding supported formats for more precise expression.
%XStandard time representation.To specify more information such as long date and short date, we recommend that you use the preceding supported formats for more precise expression.
%sUNIX timestamp.Example: 1476187251
Thank you! We've received your feedback.