Parsing timestamp from logline with promtail and sending to Loki

A couple of things catch my eye.

Your regex doesn’t use named capture groups and you are matching more than the timestamp (I see the log level in there) this will fail at your timestamp stage because you have more than just the timestamp being matched to your parse expression (the log level is in there too)

You could probably remove anything but the timestamp info from the regex or use named capture groups. The docs have some examples regex | Grafana Loki documentation

The second issue you might have is your timestamp doesn’t have time zone info in it, you should explicitly set the time zone in the timestamp stage to make sure you are parsing the timestamp with the correct time zone.

Also check out the troubleshooting section, you can test your changes more easily with promtail locally to see how the stages are being applied Troubleshooting | Grafana Loki documentation