Referencing entry timestamps from Syslog in Alloy

Grafana Alloy
1

Hello,I’m using Alloy to receive syslog logs with

loki.source.syslog "syslog" {
  listener {
    address  = "0.0.0.0:"+ sys.env("ALLOY_SYSLOG_TCP_SOURCE_PORT")
    syslog_format = "rfc3164"
    use_incoming_timestamp= true
    rfc3164_default_to_current_year= true
  }
  forward_to = [loki.write.loki.receiver]
}

Is there a way to reference the incoming timestamps in a loki.process stage? (knowing that the log line themselves don’t contain the timestamps)

2

I don’t think it’s possible, but is there a reason you want to do this? Since loki.source does the receiving, it makes sense for that resource to set the timestamp.

3

I have a slight delay between the real log timestamps and the ones generated by loki.source. I would like to keep the original timestamps, but my log source uses the RFC3164 format with a timezone different from UTC (which I cannot change). So my goal is to extract the original timestamp and apply the correct offset in a stage.timestamp.

4

If your log lines contain timestamp, then you can. It usually would involve parsing the timestamp with a regex group capture, then use stage.timestamp to set it.

5

It seems that it’s not possible then