Promtail config pipeline_stages.match.stages.timestamp.format

[HaWell]

promtail config pipeline_stages.match.stages.timestamp.format
How to format such time [2023-02-22 10:08:21601]

This is my config, but it’s invalid. It doesn’t replace time.
stages:
- regex:
expression: ‘^[(?P\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})]\s*(?P\w+)\s*[(?P<thread_name>.?)]\s(?P<class_name>.?)\s(?P<method_name>.?)\s[(?P<thread_id>.?)]\s[(?P<trace_id>.?)]\s–\s*(?P.*)$’
- multiline:
firstline: ‘^[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}]’
max_wait_time: 3s
- labels:
level:
thread_name:
class_name:
method_name:
thread_id:
trace_id:
- timestamp:
format: “yyyy-MM-dd HH:mm:ss,SSS”
source: timestamp

[tonyswumac]

Try to match the entire timestamp with regex, then format it with timestamp. Notice when you specify timestamp you give it a source timestamp, but it is nowhere to be found in your regex. So I’d try this:

-regex
  expression: '^[(?P<reg_timestamp>.*)]\s*(?P\w+)\s*[(?P<thread_name>.?)]\s(?P<class_name>.?)\s(?P<method_name>.?)\s[(?P<thread_id>.?)]\s[(?P<trace_id>.?)]\s–\s*(?P.*)$''

...

- timestamp:
    format: "2006-01-02 15:04:05,000"
    source: reg_timestamp

[HaWell]

This answer is very good. Thank you very much