Loki swap the ts value and time in explore module

Grafana Configuration
1

Hi Team,

Is it possible to swap the timestamp(ts) value in log line and time column values in each log line present in grafana explore page. Please help if there is a solution.

Thanks
Lijo

Screenshot 2022-09-12 at 3.12.53 PM
Screenshot 2022-09-12 at 3.12.53 PM1920×480 125 KB

2

Hi @lijom200,

Are you using Loki as a datasource in the explore view?

3

yes, I am using loki as a datasource.

Thanks
Lijo

4

It is doable (based on the log data you are extracting) and normally term is known as Pattern Parser.

So for e.g. here is a very good example as how to define a custom parsing pattern for Nginx logs:

https://sbcode.net/grafana/nginx-promtail/#using-the-loki-pattern-parser

Also, link to the official documentation:

I hope this helps.

5

Hi usmanahmad

Thanks for the reply.
I have a doubt here, in the above attached screenshot left most time is not from log line. Which is adding by grafana. So when i created the pattern parser i am not able to swap the “ts”(2022-09-12T09:30:28.32577027Z) value with time value (2022-09-12 15:00:28.028).

Thanks
Lijo Thomas

6

Hi @lijom200,

Hmm, if you have designed the pattern parser and only need to trim out the other details e.g. timestamp but only up to seconds,

Then you can use Functions e.g. Overwrite OR Transformations inside the Panel. Here is a small screencast of how I converted the timestamp using Overwrite:

timestamp-overwrite 2022-09-26 11-46

Also, another alternative is to define the settings in the grafana.ini configuration as shown in this post.

I hope I answer your question

7

Hello usmana_ahmad,
I just tried your solution but - it only works with AM/PM. My data is in the 24h format and I could not find any hint of how to correct this.
Your help would be highly appreciated.

8

Can you please share a screenshot of your panel where the timestamp is also visible?

9

Hello, I am also having this issue.
I have this timestamp and have tried using a transformation called “Convert field type” but cannot get the formatting right.

Can you point me in the right direction?

Here is an example of my timestamp:
timestamp:“2024-07-18T06:28:03.655”

And I am using this as the input format but it seems it might be incorrect:
YYYY-MM-DDTHH:mm:ss.SSS

Example result when using that transformation:
2024-07-18 01:23:19

and another example when using the transformation YYYY-MM-DDTHH:mm:ss.s:
2024-07-18 02:23:16.000

I have also tried using the field override but that seems to do nothing.