[Promtail] Parsing Timestamp "yyyymmdd:hhmmssssssss'

Grafana Loki
1

Hi

I am trying to parse timestamp from the log below.

(I)20250219:092344315306[085938] Recv Req :len[1076]data[1072HPS97709230010 ...

I wrote config as below, but it doesn’t work.

scrape_configs:
  - job_name: access_log
    pipeline_stages:
    - regex:
        expression: '^\(I\)(?P<timestamp>\d{8}:\d{12}).*$'
    - timestamp:
        source: timestamp
        format: "20060102:150405000000"
        location: Asia/Seoul
------------------------------------------------------------------------
inspect: regex stage]: 
{stages.Entry}.Extracted["timestamp"]:
        +: 20250219:092344315306
[inspect: timestamp stage]: none
2025-02-19T18:31:10.636988825+0900      {}      (I)20250219:092344315306[085938] Recv Req :len[1076]data[1072H

Also, when I reduced the seconds as below, it worked normally.

scrape_configs:
  - job_name: access_log
    pipeline_stages:
    - regex:
        expression: '^\(I\)(?P<timestamp>\d{8}:\d{6}).*$'
    - timestamp:
        source: timestamp
        format: "20060102:150405"
        location: Asia/Seoul
-------------------------------------------------------------------------
[inspect: regex stage]: 
{stages.Entry}.Extracted["timestamp"]:
        +: 20250219:092344
[inspect: timestamp stage]: 
{stages.Entry}.Entry.Entry.Timestamp:
        -: 2025-02-19 18:32:33.178119831 +0900 KST
        +: 2025-02-19 09:23:44 +0900 KST
2025-02-19T09:23:44+0900        {}      (I)20250219:092344315306[085938] Recv Req :len[1076]data[1072H

I am trying to parse based on the original seconds. Is there a way to solve it?

2

I think you need a separator between second and nanoseconds, like 20250219:092344.315306 for example. You might have to do something like this (not tested):

- regex:
    expression: `^\(I\)(?P<timestamp_p1>\d{8}:\d{6})(?P<timestamp_p2>\d{6}).*$`

- templte:
    source: reformed_timestamp
    template: '{{ .timestamp_p1}}.{{ .timestamp_p2 }}'

- timestamp:
    source: reformed_timestamp
    format: "20060102:150405.000000"
    location: Asia/Seoul
3

It works perfectly.
Thank you very much for your kindness.