Log Timestamp period

Grafana Alloy
1

Hello, I am getting this error, when trying to parse old logs..

ts=2025-03-20T10:05:15.07876863Z level=error msg="final error sending batch" component_path=/ component_id=loki.write.loki_receiver component=client host=loki:8082 status=400 tenant="" error="server returned HTTP status 400 Bad Request (400): entry with timestamp 2025-03-16 18:30:00 +0000 UTC ignored, reason: 'entry too far behind, entry timestamp is: 2025-03-16T18:30:00Z, oldest acceptable timestamp is: 2025-03-19T06:34:49Z',"

Why this error?

I am trying to take out the timestamp time from my log data and overwritting it to Loki.

Requesting Solution for the error

Based on the log generated timestamp and the oldest acceptable timestamp, there is only like 28 hours of difference. Can I actually increase the oldest acceptable timestamp..?

2
  1. You cannot change logs once they are ingested into Loki.
  2. You cannot send older logs to a log stream where newer logs are already present.
3

Ok, thank you for the information.
Actually, here is the scenario - due to some issue, let’s say my Alloy has stopped for some days, and logs for those days has been missed. So, I want those logs with proper time to be sent to loki right..? So, that’s why I was asking for a Solution for the time period.

I am not sure, but maybe your information is the reason why I got the error like that which I had posted above. Later, now when I ingested the older logs it came properly with proper time adjusted. From this, I got to know that it can only convert timestamp for the last 7 days, which is actually enough for me.

If someone viewing this with the issue regarding timestamp conversion, even though it is in RFC3339 format or whichever format you’re using.
Here is the solution that you need to keep so, it works properly..

RFC3339 only

loki.process "log_processing" {
  stage.json {
    expressions = { time = "timestamp" }
  }
  // required stage for proper working...
  stage.regex {
      expression = "(?P<time>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.\\d+Z)"
  }
  stage.timestamp {
    source = "time"
    format = "RFC3339"
  }
  forward_to = [loki.write.loki_receiver.receiver]
}

Thanks once again, this is now resolved…