If you use Logtail to collect logs, you must specify time formats based on the time strings in raw logs. Logtail extracts a time string from a raw log and parses the string into a UNIX timestamp. This topic describes the time formats that are commonly used in logs and provides examples for the time formats.

Commonly used time formats in logs

The following table describes the time formats that are supported by Logtail.
Note
  • The timestamp of a log in Log Service is accurate to the second. Therefore, you need only to specify a time format that is accurate to the second.
  • You need only to specify a time format for the time part in a time string. You do not need to specify a time format for other parts such as a time zone.
  • If Logtail is installed on a Linux server, Logtail supports all the time formats that are supported by the strftime function. If the time string in a log can be formatted by the strftime function, the time string can be parsed and used by Logtail.
Time format Description Example
%a The abbreviated name of the day of the week. Fri
%A The full name of the day of the week. Friday
%b The abbreviated name of the month. Jan
%B The full name of the month. January
%d The day of the month. The value is in the decimal format. Valid values: 01 to 31. 07, 31
%h The abbreviated name of the month. The format is equivalent to %b. Jan
%H The hour. The 24-hour clock is used. 22
%I The hour. The 12-hour clock is used. 11
%m The month. The value is in the decimal format. Valid values: 01 to 12. 08
%M The minute. The value is in the decimal format. Valid values: 00 to 59. 59
%n The line feed. Line feed
%p The abbreviation that indicates the morning or afternoon. Valid values: AM and PM. AM or PM
%r The time. The 12-hour clock is used. The format is equivalent to %I:%M:%S %p. 11:59:59 AM
%R The time. Hours and minutes are included. The format is equivalent to %H:%M. 23:59
%S The second. The value is in the decimal format. Valid values: 00 to 59. 59
%t The tab character. None
%y The two-digit number of the year. The value is in the decimal format. Valid values: 00 to 99. 04 or 98
%Y The four-digit number of the year. The value is in the decimal format. 2004 or 1998
%C The two-digit number of the century. The value is in the decimal format. Valid values: 00 to 99. 16
%e The day of the month. The value is in the decimal format. Valid values: 1 to 31.

Prefix a single-digit number with a space.

7 or 31
%j The day of the year. The value is in the decimal format. Valid values: 001 to 366. 365
%u The day of the week. The value is in the decimal format. Valid values: 1 to 7. The value 1 indicates Monday. 2
%U The week of the year. Sunday is the first day of each week. Valid values: 00 to 53. 23
%V The week of the year. Monday is the first day of each week. Valid values: 01 to 53.

If a week on which January 1 falls has four or more days in January, the week is considered the first week of the year. Otherwise, the following week is considered the first week of the year.

24
%w The day of the week. The value is in the decimal format. Valid values: 0 to 6. The value 0 indicates Sunday. 5
%W The week of the year. Monday is the first day of each week. Valid values: 00 to 53. 23
%c The date and time that follows the ISO 8601 standard. Tue Nov 20 14:12:58 2020
%x The date that follows the ISO 8601 standard. Tue Nov 20 2020
%X The time that follows the ISO 8601 standard. 11:59:59
%s The UNIX timestamp. 1476187251

Examples

The following table lists commonly used time standards and time expressions, and provides related examples.

Example Time expression Time standard
2017-12-11 15:05:07 %Y-%m-%d %H:%M:%S User-defined
[2017-12-11 15:05:07.012] [%Y-%m-%d %H:%M:%S] User-defined
02 Jan 06 15:04 MST %d %b %y %H:%M RFC822
02 Jan 06 15:04 -0700 %d %b %y %H:%M RFC822Z
Monday, 02-Jan-06 15:04:05 MST %A, %d-%b-%y %H:%M:%S RFC850
Mon, 02 Jan 2006 15:04:05 MST %A, %d %b %Y %H:%M:%S RFC1123
2006-01-02T15:04:05Z07:00 %Y-%m-%dT%H:%M:%S RFC3339
2006-01-02T15:04:05.999999999Z07:00 %Y-%m-%dT%H:%M:%S RFC3339Nano
1637843406 %s User-defined
1637843406123 %s User-defined (Log Service considers second as the precision of the time.)