If you use Logtail to collect logs, you must specify time formats based on the time strings in raw logs. Logtail extracts a time string from a raw log and parses the string into a UNIX timestamp. This topic describes the time formats that are commonly used in logs and provides examples for the time formats.
Commonly used time formats in logs
- The timestamp of a log in Log Service is accurate to the second by default. Therefore,
you need to only specify a time format that is accurate to the second.
If the value of the time field in raw logs has a higher time precision, such as the millisecond, microsecond, or nanosecond, and you want to retain the time precision for the logs in Log Service, you can add the enable_precise_timestamp parameter in the extended settings for your Logtail and set the parameter value to true. For more information, see Advanced settings and Parameters of advanced.
- You need to only specify a time format for the time part in a time string. You do not need to specify a time format for other parts such as a time zone.
- If Logtail is installed on a Linux server, Logtail supports all the time formats that are supported by the strftime function. If the time string in a log can be formatted by the strftime function, the time string can be parsed and used by Logtail.
| Time format | Description | Example |
|---|---|---|
| %a | The abbreviated name of the day of the week. | Fri |
| %A | The full name of the day of the week. | Friday |
| %b | The abbreviated name of the month. | Jan |
| %B | The full name of the month. | January |
| %d | The day of the month. The value is in the decimal format. Valid values: 01 to 31. | 07, 31 |
| %h | The abbreviated name of the month. The format is equivalent to %b. | Jan |
| %H | The hour. The 24-hour clock is used. | 22 |
| %I | The hour. The 12-hour clock is used. | 11 |
| %m | The month. The value is in the decimal format. Valid values: 01 to 12. | 08 |
| %M | The minute. The value is in the decimal format. Valid values: 00 to 59. | 59 |
| %n | The line feed. | Line feed |
| %p | The abbreviation that indicates the morning or afternoon. Valid values: AM and PM. | AM or PM |
| %r | The time. The 12-hour clock is used. The format is equivalent to %I:%M:%S %p. | 11:59:59 AM |
| %R | The time. Hours and minutes are included. The format is equivalent to %H:%M. | 23:59 |
| %S | The second. The value is in the decimal format. Valid values: 00 to 59. | 59 |
| %t | The tab character. | None |
| %y | The two-digit number of the year. The value is in the decimal format. Valid values: 00 to 99. | 04 or 98 |
| %Y | The four-digit number of the year. The value is in the decimal format. | 2004 or 1998 |
| %C | The two-digit number of the century. The value is in the decimal format. Valid values: 00 to 99. | 16 |
| %e | The day of the month. The value is in the decimal format. Valid values: 1 to 31.
Prefix a single-digit number with a space. |
7 or 31 |
| %j | The day of the year. The value is in the decimal format. Valid values: 001 to 366. | 365 |
| %u | The day of the week. The value is in the decimal format. Valid values: 1 to 7. The value 1 indicates Monday. | 2 |
| %U | The week of the year. Sunday is the first day of each week. Valid values: 00 to 53. | 23 |
| %V | The week of the year. Monday is the first day of each week. Valid values: 01 to 53.
If a week on which January 1 falls has four or more days in January, the week is considered the first week of the year. Otherwise, the following week is considered the first week of the year. |
24 |
| %w | The day of the week. The value is in the decimal format. Valid values: 0 to 6. The value 0 indicates Sunday. | 5 |
| %W | The week of the year. Monday is the first day of each week. Valid values: 00 to 53. | 23 |
| %c | The date and time that follows the ISO 8601 standard. | Tue Nov 20 14:12:58 2020 |
| %x | The date that follows the ISO 8601 standard. | Tue Nov 20 2020 |
| %X | The time that follows the ISO 8601 standard. | 11:59:59 |
| %s | The UNIX timestamp. | 1476187251 |
Examples
The following table lists commonly used time standards and time expressions, and provides related examples.
| Example | Time expression | Time standard |
|---|---|---|
| 2017-12-11 15:05:07 | %Y-%m-%d %H:%M:%S | User-defined |
| [2017-12-11 15:05:07.012] | [%Y-%m-%d %H:%M:%S | User-defined |
| 02 Jan 06 15:04 MST | %d %b %y %H:%M | RFC822 |
| 02 Jan 06 15:04 -0700 | %d %b %y %H:%M | RFC822Z |
| Monday, 02-Jan-06 15:04:05 MST | %A, %d-%b-%y %H:%M:%S | RFC850 |
| Mon, 02 Jan 2006 15:04:05 MST | %A, %d %b %Y %H:%M:%S | RFC1123 |
| 2006-01-02T15:04:05Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339 |
| 2006-01-02T15:04:05.999999999Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339Nano |
| 1637843406 | %s | User-defined |
| 1637843406123 | %s | User-defined (Log Service considers second as the precision of the time.) |