Rigth parsed time not promote to timestamp stage promtail

Grafana Loki
1

I am parsing a log with promtail, I am running it in the console to analize the errors because I don’t get any error in the log.

My goal is to parse timestamp from the logs to use as the default timestamp in loki.

This is my output in the console:

2022-11-11T19:12:41.582800328-0300  {__path__="/var/log2/*", job="jobprueba", serial="12345678916", time="2022-11-11T18:37:11-03"}  12345678916 2022-11-11T18:37:11-03:00  3396  5008 I cvip-ch :  0000016359280949381 ARM.02 00888 HP_PPRIOR       [rm/src/headpose_arm_blocks.cpp:00260]:W:: WCAM image timestamps too far apart 192us at ts 7617862216
[inspect: regex stage]: 
{stages.Entry}.Extracted["serial"]:
    +: 12345678917
{stages.Entry}.Extracted["time"]:
    +: 2022-11-11T18:37:12-03
[inspect: regex stage]: 
{stages.Entry}.Extracted["serial"]:
    +: 12345678918
{stages.Entry}.Extracted["time"]:
    +: 2022-11-11T18:37:13-03
[inspect: labels stage]: 
{stages.Entry}.Entry.Labels:
    -: {__path__="/var/log2/*", job="jobprueba"}
    +: {__path__="/var/log2/*", job="jobprueba", serial="12345678917", time="2022-11-11T18:37:12-03"}
[inspect: labels stage]: 
{stages.Entry}.Entry.Labels:
    -: {__path__="/var/log2/*", job="jobprueba"}
    +: {__path__="/var/log2/*", job="jobprueba", serial="12345678918", time="2022-11-11T18:37:13-03"}
[inspect: timestamp stage]: none
[inspect: timestamp stage]: none

this my config.yaml

scrape_configs:
  - job_name: jobprueba
    pipeline_stages:
      - regex:
          expression: '^(?P<serial>\w+) (?P<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2})(.*)

As you can see time is extrated but not promote to timestamp stage.

Thank you.
- labels:
serial:
time:
- timestamp:
source: time
# 2006-01-02T15:04:05-07:00 RFC3339
format: RFC3339
#format: 2006-02-01T15:04:05.000
#location: “America/Buenos_Aires”
static_configs:
- targets:
- localhost
labels:
job: jobprueba
path: /var/log2/*


As you can see time is extrated but not promote to timestamp stage.

Thank you.
2

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.