You can use a Logtail plug-in to parse the time field of a log and specify the parsing result as the value for the __time__ field in the log.
Entry point
If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.
Configuration description
Parameter | Description |
Original Field | The original field that is used to store the content of a log before the log is parsed. Default value: content. |
Time Format | The time format. Specify a time format based on the time content in the log. For example, if the time in the log is 10/Sep/2023:12:36:49, the time conversion format is %d/%b/%Y:%H:%M:%S. For more information, see Common log time formats. |
Time Zone | The time zone of the log time field. If you do not select this parameter, the time zone of the environment where the Logtail process resides is used by default. |
Common log time formats
The following table describes the time formats that are supported by Logtail.
By default, the timestamp of a log in Simple Log Service is accurate to seconds. You can specify the time format only to seconds.
If Logtail is installed on a Linux server, Logtail supports all time formats that are supported by the strftime function. If the time string in a log can be formatted by the strftime function, the time string can be parsed and used by Logtail.
Time format | Description | Example |
%a | The abbreviated name of the day of the week. | Fri |
%A | The full name of the day of the week. | Friday |
%b | The abbreviated name of the month. | Jan |
%B | The full name of the month. | January |
%d | The day of the month. The value is in the decimal format. Valid values: 01 to 31. | 07, 31 |
%h | The abbreviated name of the month. The format is equivalent to %b. | Jan |
%H | The hour. The 24-hour clock is used. | 22 |
%I | The hour. The 12-hour clock is used. | 11 |
%m | The month. The value is in the decimal format. Valid values: 01 to 12. | 08 |
%M | The minute. The value is in the decimal format. Valid values: 00 to 59. | 59 |
%n | The line feed. | Line feed |
%p | The abbreviation that indicates the morning or afternoon. Valid values: AM and PM. | AM or PM |
%r | The time. The 12-hour clock is used. The format is equivalent to %I:%M:%S %p. | 11:59:59 AM |
%R | The time. Hours and minutes are included. The format is equivalent to %H:%M. | 23:59 |
%S | The second. The value is in the decimal format. Valid values: 00 to 59. | 59 |
%t | The tab character. | None |
%y | The two-digit number of the year. The value is in the decimal format. Valid values: 00 to 99. | 04 or 98 |
%Y | The four-digit number of the year. The value is in the decimal format. | 2004 or 1998 |
%C | The two-digit number of the century. The value is in the decimal format. Valid values: 00 to 99. | 16 |
%e | The day of the month. The value is in the decimal format. Valid values: 1 to 31. Prefix a single-digit number with a space. | 7 or 31 |
%j | The day of the year. The value is in the decimal format. Valid values: 001 to 366. | 365 |
%u | The day of the week. The value is in the decimal format. Valid values: 1 to 7. The value 1 indicates Monday. | 2 |
%U | The week of the year. Sunday is the first day of each week. Valid values: 00 to 53. | 23 |
%V | The week of the year. Monday is the first day of each week. Valid values: 01 to 53. If a week on which January 1 falls has four or more days in January, the week is considered the first week of the year. Otherwise, the following week is considered the first week of the year. | 24 |
%w | The day of the week. The value is in the decimal format. Valid values: 0 to 6. The value 0 indicates Sunday. | 5 |
%W | The week of the year. Monday is the first day of each week. Valid values: 00 to 53. | 23 |
%c | The date and time that follows the ISO 8601 standard. | Tue Nov 20 14:12:58 2020 |
%x | The date that follows the ISO 8601 standard. | Tue Nov 20 2020 |
%X | The time that follows the ISO 8601 standard. | 11:59:59 |
%s | The UNIX timestamp. | 1476187251 |
Examples
The following table describes common time standards and time expressions, and provides related examples.
Example | Time expression | Time standard |
2017-12-11 15:05:07 | %Y-%m-%d %H:%M:%S | Custom |
[2017-12-11 15:05:07.012] | [%Y-%m-%d %H:%M:%S | Custom |
02 Jan 06 15:04 MST | %d %b %y %H:%M | RFC822 |
02 Jan 06 15:04 -0700 | %d %b %y %H:%M | RFC822Z |
Monday, 02-Jan-06 15:04:05 MST | %A, %d-%b-%y %H:%M:%S | RFC850 |
Mon, 02 Jan 2006 15:04:05 MST | %A, %d %b %Y %H:%M:%S | RFC1123 |
2006-01-02T15:04:05Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339 |
2006-01-02T15:04:05.999999999Z07:00 | %Y-%m-%dT%H:%M:%S | RFC3339Nano |
1637843406 | %s | Custom |
1637843406123 | %s | Custom (Simple Log Service considers second as the precision of the time.) |