Configure promtail to extract timestamp from log line

I’m using grafana enterprise version 10 on windows 11

I want to extract the timestamp of the log line , from the line itself ,
here is a sample log line :
2023-06-13 13:48:26.7314 293092600282 GetPassportFromStorage() GetSensorStatus.success = False

I used the following config :

http_listen_port: 9080
grpc_listen_port: 0

filename: D:/tmp/positions.yaml



  • job_name: windows-logs
    • timestamp:
      source: timestamp
      format: ‘2006-01-02 15:04:05.0000’ # Adjust the format based on your log timestamp format
    • targets:
      • localhost
        job: OmarLaptop
        agent: promtail
        path: D:/MyLogs/*.log

but it seems that log shown in Grafana Loki , not preserve the right timestamp

How to extract the timestamp from the Log Line itself ,

I read the pipeline docs for promtail and found the following for timestamp stage ,

but I’m confused how to use it

Thank You.

To extract the timestamp from a log line. First use a regex expression (golang flavor) that will extract the characters that match the timestamp. Then, we can use an appropriate format in the timestamp stage, adding the time zone if necessary.
For your example, replace the timestamp section with this :

  - regex:
      expression: '^(?P<timestamp>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})'
  - timestamp:
      source: timestamp
      format: '2006-01-02 15:04:05.000'
      location: 'Etc/GMT-0'