Issue with pipeline_stages using timestamp

Grafana Loki
1

I am trying to get my IIS logs into loki. I want the log timestamps to be used as the timestamp passed to loki. Here is my promtail config:

scrape_configs:
  - job_name: pmsi-iis
    static_configs:
      - targets: [localhost]
        labels:
          job: pmsi-iis
          __path__: /var/log/pmsi-iis/*.log

    pipeline_stages:
      - drop:
          expression: '^#'

      - regex:
          expression: '^(?P<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})'
          
      - timestamp:
          source: timestamp
          format: '2006-01-02 15:04:05'
          location: America/Los_Angeles

I don’t get any errors in the promtail log. I actually see this:

level=debug ts=2025-08-26T23:37:34.106213223Z caller=regex.go:132 component=file_pipeline component=stage type=regex msg="extracted data debug in regex stage" extracteddata="map[filename:/var/log/pmsi-iis/test37.log job:pmsi-iis timestamp:2025-08-25 00:00:06]"

Here is the log data:

2025-08-25 00:00:08 10.35.65.127 GET /api/pms/fm/faxes/queues/93/faxes/ include=document+document.mediaType+metadata.locked.byUser+notes+priority+source&filter=metadata.canceled.timestamp+eq+null&group=metadata.locked.byUser.id%20eq%20%277503%27&top=25 443 - 10.35.65.117 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/139.0.0.0+Safari/537.36+Edg/139.0.0.0 https://essette.prospectmedical.com/app/ 200 0 0 2395

The problem is that when I go to Grafana and query loki I don’t see any log data. I made sure the time range is set to include 2025-08-25.

When I take out the timestamp section in the config the log data shows up in Loki, but has the timestamp when it was injested, not from the log.

What is wrong with my config?

2

Loki won’t accept older logs in the same log stream (logs with the same labels) if newer logs already exist with the same set of labels. So if you already send some logs to Loki, and then later send the same logs with an older timestamp, with the same set of labels, it’ll be discarded. If this is the case, you’ll see some logs in your ingester saying so. You can also easily test this by added an arbitrary label.