Timestamps

Simply put, timestamps are the part of the log event that tells you when stuff happens. When an event triggers a log, most log formats include a timestamp that tells the user when the event happened. Timestamps are incredibly important since they drive a number of important activities in Loggly. Most importantly, Loggly uses timestamps to filter data in your search results. It also uses timestamps to determine when logs are beyond your account’s record retention limit and should be discarded.

The concept is fairly simple, but there are a few things you should know about how Loggly handles timestamps.

Where does the timestamp come from?

Where the timestamp comes from depends on the type of log data you’re sending through. Timestamps will be prioritized in the order below:

• Parsed Log Data. If your log data is of a supported log type, then Loggly will use the timestamp that was included with the event, as it was written by your application. Some types of JSON timestamps are parsed out.

• Syslog. If your data is forwarded by a syslog service, there is a timestamp embedded in the header that Loggly can pull out and use.

• HTTP. If your data is forwarded over HTTP/S, the reception time is used as the timestamp. (Unless the data can be parsed.)

Timezones

Loggly can display events in either your local or UTC timezone. This will make it easier to read your events, trends, and even dashboards. You won’t need to do mental math to convert the timezone. Furthermore, even if you have servers spread across multiple timezones, all your events will be displayed in local or UTC time. By default, users will see events in local time according to their own browser.

Some people prefer to work in UTC time. For example, you may prefer using a single standard time if you have co-workers in multiple timezones. Each user can change it back to UTC by clicking Use UTC Time in their account settings.

Drift Correction

When Loggly finds that the difference between the event and reception timestamps (that is, the drift) is greater than a small value, it will automatically correct your event timestamp. Why do Loggly do this? Well, SolarWinds has found that when the drift is greater than a certain amount, the lag can usually be attributed to the event timestamp not being corrected for timezone changes. This can create issues when Loggly indexes for search so SolarWinds worked out a way to correct for that issue.

Let’s walk through an example.

Say the event timestamp in your log is 14:01, but no timezone is included. Loggly notes the reception timestamp as 18:01 UTC. Four hours is a huge lag – so it adjusts your event timestamp to 18:01 to correct for what we appears to be a difference due to timezones.

What if there is true drift?

An actual difference between the event and reception timestamp, where the drift is not due to unrelated influences such as a difference in timezone or an error in server time would be considered true drift. For example, the event timestamp is 14:01 with a reception timestamp of 18:03. In this case Loggly assumes that the true drift is +00:02 and it will correct the event timestamp to 18:01.

Age Limits

Loggly is designed for near real-time log streaming, so if your timestamps are greater than 7 days in the past, Loggly will use the time the event was received. Events will not show up in your account if they include timestamps that are older than your retention period, or older than the age of your account.