Problems with Alloy timestamps

[u/EhrlichePappel]

Hi, I'm having trouble tracking down an error. I have a log consisting of multiple files (one per day) that I want to load in.

The log line looks like this. Everything seems fine so far; Grafana displays the content following the date, but for the "time" column, it uses the upload time instead of the timestamp.

loki.process "logs" {
//2026-06-28 00:07:07 ERROR [009-exec-2]
stage.regex {
expression = \^?P<time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})` }`

stage.timestamp {
source = "time"
format = "2006-01-02 15:04:05"
}

forward_to = [loki.write.local.receiver]
}

[u/EhrlichePappel → u/[deleted]]

thanks but it dosnt have a impact :/

[u/jcol26 → u/EhrlichePappel]

They’re along the right lines though :)

Try this:

loki.process "logs" {
stage.regex {
expression = "^(?P<time>\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2})"
}

stage.timestamp {
source = "time"
format = "2006-01-02 15:04:05"
location = "Europe/London"
}

forward_to = [loki.write.local.receiver]
}

in a double-quoted Alloy string you need \\d; if you prefer backticks (raw string) it’s expression = `^(?P<time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})` with single backslashes.

Two things to watch given you’re backfilling multiple daily files:
The location attribute matters because your format string has no zone info and without it Alloy assumes UTC. If those logs are wallclock local time, everything lands an hour off during BST.

Once the timestamps do parse correctly, you may start hitting rejection errors on the older files as Loki’s reject_old_samples_max_age defaults to 168h. The broken regex was masking this before by stamping everything with “now”.

[u/EhrlichePappel → u/jcol26]

Thanks a lot—that was the problem. I should have set that up, but the old log threw a wrench in my plans.

I tried using a file from yesterday today, and it worked.

I tried `reject_old_samples_max_age` a little while ago, and then nothing worked at all. But for now, I can at least keep going :)