You can use a Logtail plug-in to parse the time field of a log and specify the parsing result as the value for the __time__ field in the log.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.
Configuration description
Parameter | Description |
Original Field | The original field that stores the log content before parsing. Default value: content. |
Time Format | The time format. Specify a time format based on the time in a log. For example, if the time in a log is 10/Sep/2023:12:36:49, the time conversion format is %d/%b/%Y:%H:%M:%S. For more information, see Common log time formats. |
Time Zone | The time zone of the log time field. If you do not configure this parameter, the time zone of the environment where the Logtail process resides is used by default. |
Common log time formats
The following table describes the time formats that are supported by Logtail.
By default, the timestamp of a log in Simple Log Service is accurate to the second. In this case, you need to only specify a time format that is accurate to the second.
If the value of the time field in raw logs has a higher time precision, such as the millisecond, microsecond, or nanosecond, and you want to retain the time precision for the logs in Simple Log Service, you can configure the related settings. For more information, see Parse nanosecond-precision timestamps from raw logs when you use Logtail to collect logs.
If Logtail is installed on a Linux server, Logtail supports all time formats that are supported by the strftime function. If the time string in a log can be formatted by the strftime function, the time string can be parsed and used by Logtail.
Time format | Description | Example |
%a | The abbreviated name of the day of the week. | Fri |
%A | The full name of the day of the week. | Friday |
%b | The abbreviated name of the month of the year. | Jan |
%B | The full name of the month of the year. | January |
%d | The day of the month. The value is in the decimal format. Valid values: 01 to 31. | 07, 31 |
%f | The fractional part of the second. Unit: milliseconds, microseconds, or nanoseconds. | 123 |
%h | The abbreviated name of the month of the year. The format is equivalent to %b. | Jan |
%H | The hour. The 24-hour clock is used. | 22 |
%I | The hour. The 12-hour clock is used. | 11 |
%m | The month. The value is in the decimal format. Valid values: 01 to 12. | 08 |
%M | The minute. The value is in the decimal format. Valid values: 00 to 59. | 59 |
%n | The line feed. | Line feed |
%p | The abbreviation that indicates the morning or afternoon. Valid values: AM and PM. | AM or PM |
%r | The time. The 12-hour clock is used. The format is equivalent to %I:%M:%S %p. | 11:59:59 AM |
%R | The time in hours and minutes. The format is equivalent to %H:%M. | 23:59 |
%S | The second. The value is in the decimal format. Valid values: 00 to 59. | 59 |
%t | The tab character. | None |
%y | The two-digit number of the year. The value is in the decimal format. Valid values: 00 to 99. | 04 or 98 |
%Y | The four-digit number of the year. The value is in the decimal format. | 2004 or 1998 |
%C | The two-digit number of the century. The value is in the decimal format. Valid values: 00 to 99. | 16 |
%e | The day of the month. The value is in the decimal format. Valid values: 1 to 31. Prefix a single-digit number with a space. | 7 or 31 |
%j | The day of the year. The value is in the decimal format. Valid values: 001 to 366. | 365 |
%u | The day of the week. The value is in the decimal format. Valid values: 1 to 7. The value 1 indicates Monday. | 2 |
%U | The week of the year. Sunday is the first day of each week. Valid values: 00 to 53. | 23 |
%V | The week of the year. Monday is the first day of each week. Valid values: 01 to 53. If the week in which January 1 occurs has four or more days in January, the week is considered the first week of the year. Otherwise, the following week is considered the first week of the year. | 24 |
%w | The day of the week. The value is in the decimal format. Valid values: 0 to 6. The value 0 indicates Sunday. | 5 |
%W | The week of the year. Monday is the first day of each week. Valid values: 00 to 53. | 23 |
%c | The date and time that follows the ISO 8601 standard. | Tue Nov 20 14:12:58 2020 |
%x | The date that follows the ISO 8601 standard. | Tue Nov 20 2020 |
%X | The time that follows the ISO 8601 standard. | 11:59:59 |
%s | The UNIX timestamp. | 1476187251 |
Examples
The following table describes common time standards and time expressions, and provides related examples.
Example | Time expression | Time standard |
2017-12-11 15:05:07 | %Y-%m-%d %H:%M:%S | Custom |
[2017-12-11 15:05:07.012] | [%Y-%m-%d %H:%M:%S | Custom |
2017-12-11 15:05:07.123 | %Y-%m-%d %H:%M:%S.%f | Custom |
02 Jan 06 15:04 MST | %d %b %y %H:%M | RFC822 |
02 Jan 06 15:04 -0700 | %d %b %y %H:%M | RFC822Z |
Monday, 02-Jan-06 15:04:05 MST | %A, %d-%b-%y %H:%M:%S | RFC850 |
Mon, 02 Jan 2006 15:04:05 MST | %A, %d %b %Y %H:%M:%S | RFC1123 |
2006-01-02T15:04:05Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339 |
2006-01-02T15:04:05.999999999Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339Nano |
1637843406 | %s | Custom |
1637843406123 | %s | Custom (Simple Log Service considers seconds as the precision of the time.) |