How to read only time from promtail logs and preserve system timezone?

Grafana Loki
1

I am in New York. I have a log file in /dir/20240829/logfile with lines in the form:

09:54:13.123456 [blabla]

I want to read timestamp from the log line. I do the following, where .date is the date extracted from filename:

- regex: { expression: '^(?P<hhmmss>[0-9][0-9]:[0-9][0-9]:[0-9][0-9][.][0-9]+).*' }
- template: { source: time, template: '{{.date}} {{.hhmmss}}' }                                                                         
- timestamp: { source: time, format: "20060102 03:04:05.000000", location: America/New_York }

This however cases the lines to be in the future because promtail sends the lines in UTC timezone. How do I tell promtail the timezone of log lines?

2
  1. Where is your {{.date}} coming from?
  2. Run promtail in debug mode with inspection enabled to see what labels are parsed (specifically the time field).
3

Fun fact: the foramt is wrong. It should have been 20060102 15:04:05.000000. Crisis averted! Thanks anyway :wink: