How to extract timestamp from log itself in Loki

Question

There is a time filter by default in grafana dashboard. It filters by the time the log was sent to grafana from loki. I want to change that time to the timestamp in the log (a label). Is it possible and if yes how?

I am expecting to filter the logs by the timestamp on my log rather than the time the log was sent to grafana.

Answer 1

Based on the fact that time when log occurred, and time when it was sent to Loki differ, I assume you are using Promtail as a log scraping agent.

Promtail provides a stage timestamp exactly for this reason: to replace associated timestamp. From official documentation:

The timestamp stage is an action stage that can change the timestamp of a log line before it is sent to Loki. When a timestamp stage is not present, the timestamp of a log line defaults to the time when the log entry is scraped.

A couple examples of how this stage can be used are listed in the Promtail configuration overview.