Alloy – loki.process stage.timestamp not rewriting the timestamp

Grafana Alloy
1

Hi folks! I’ve got some issues with processing logs with Alloy before forwarding it to loki.

Here is an example log line I am concerned with right now:

{"level":"info","record_type":1,"card_present":true,"driver_present":false,"team":false,"work_type":0,"timestamp":"2024-09-23T00:00:00Z","time":"2025-01-10T17:45:45+01:00"}

The logger I am using is zerolog

Here is the alloy config:

local.file_match "tacho_json" {
	path_targets = [
		{__path__ = "/tmp/tacho.json"},
	]
}

loki.source.file "tacho_json" {
	targets    = local.file_match.tacho_json.targets
	forward_to = [loki.process.parse_json.receiver]
}

loki.process "parse_json" {
	forward_to = [loki.write.default.receiver]

	stage.match {
		selector = "{record_type=\"1\"}"

		stage.json {
			expressions = {timestamp = "", work_type = "", record_type = "", drive_present = "", card_present = "", team = ""}
		}

		stage.timestamp {
			source = "timestamp"
			format = "RFC3339"
		}
	}
}

loki.write "default" {
	endpoint {
		url     = "http://loki-gateway.o11y/loki/api/v1/push"
		headers = {
			"X-Scope-OrgID" = "1",
		}
	}
}

From my understanding – loki should rewrite the original timestamp for the timestamp in the JSON, yet it seems to completely ignore this pipeline stage.

It’s my first time setting up Alloy and Loki, so I might have missed something. But as of right now I am utterly confused :confused:

Can someone please help me understand?

2

This is not a RFC3339 timestamp. According to time package - time - Go Packages RFC3339 should look like this:

	RFC3339     = "2006-01-02T15:04:05Z07:00"

Maybe consider using custom timestamp format.

3

This is a RFC3339 timestamp though.

package main

import (
        "fmt"
        "time"
)

func main() {
        t, err := time.Parse(time.RFC3339, "2024-09-23T00:00:00Z")
        if err != nil {
                fmt.Println(err)
        }
        fmt.Println(t)
}

returns

go run main.go
2024-09-23 00:00:00 +0000 UTC
4

You are right, it does parse.

You essentially have a match, json, and timestamp blocks, so we would probably just have to test them one by one and see which one is problematic, for example:

  1. Try removing the match block and see if that gets it to work.
  2. Try setting labels for some of the fields parsed from json, maybe set record_type and see if it shows up.