Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
**Advance options** for log collection can be used as follows:
* **Timestamp Format**. By default, Sumo Logic will automatically detect the timestamp format of your logs. However, you can manually specify a timestamp format for a source by configuring the following:
- **Timestamp locator**. Use a [Go regular expression](https://github.com/google/re2/wiki/Syntax) to match the timestamp in your logs. Ensure the regular expression includes a named capture group called `timestamp_field`.
- **Layout**. Specify the exact layout of the timestamp to be parsed. For example, `- %Y-%m-%dT%H:%M:%S.%LZ`. To learn more about the formatting rules, refer to [this guide](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/internal/coreinternal/timeutils/internal/ctimefmt/ctimefmt.go#L68).
- **Layout**. Specify the exact layout of the timestamp to be parsed. For example, `- %Y-%m-%dT%H:%M:%S.%LZ`. To learn more about the formatting rules, refer to [this guide](/docs/send-data/opentelemetry-collector/time-reference/).
- **Location (Time zone)**. Define the geographic location (timezone) to use when parsing a timestamp that does not include a timezone. The available locations depend on the local IANA Time Zone database. For example, `America/New_York`. See more examples [here](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
9 changes: 9 additions & 0 deletions docs/send-data/opentelemetry-collector/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,15 @@ In this section, we'll introduce the following concepts:
</a>
<p>Perform string hashing and masking operations using the Transform Processor and OTTL in OpenTelemetry.</p>
</div>
</div>
<div className="box smallbox card">
<div className="container">
<a href="/docs/send-data/opentelemetry-collector/time-reference">
<img src={useBaseUrl('img/send-data/otel-color.svg')} alt="OTel thumbnail icon" width="25" />
<h4>OTel Timestamps Date Formats</h4>
</a>
<p>Learn how Sumo Logic manages OTel timestamps and the configuration options that are available.</p>
</div>
</div>
<div className="box smallbox card">
<div className="container">
Expand Down
102 changes: 102 additions & 0 deletions docs/send-data/opentelemetry-collector/time-reference.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
---
id: time-reference
title: Timestamps, Time Zones, Time Ranges, and Date Formats for OpenTelemetry Collector
sidebar_label: Timestamps, Time Zones, Time Ranges, and Date Formats
description: Learn about timestamp formats recognized by the Sumo Logic OpenTelemetry (OTel) Collector and available configuration options.
keywords:
- timestamp
- otel collector
- time
- time reference
- timezone
- time zone
---

import useBaseUrl from '@docusaurus/useBaseUrl';

:::info
This page lists timestamp formats, time zones, time ranges, and date handling specific to the Sumo Logic OpenTelemetry (OTel) Collector. For general timestamp and time management across all data sources, see [Timestamps, Time Zones, Time Ranges, and Date Formats](https://github.com/docs/send-data/reference-information/time-reference).
:::

We support several options for timestamps. When collecting log data, the timestamp attached to messages is vital, both for the integrity of the data in your account, and for accurate query results.

Because of the importance of timestamps, Sumo Logic indexes the timestamp of each message, making sure that data relevant to a query’s time range is returned properly in search results, which allows you to reconstruct a correct event timeline.

## Timestamps

The timestamp is the part of a log message that marks the time that an event occurred. During ingestion, we can detect the message timestamp, convert it to Unix epoch time (the number of milliseconds since midnight, January 1, 1970 UTC), and index it. The timestamp is parsed either using the default timestamp parsing settings, or a custom format that you specify.

### OTel automated timestamp parsing

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per @echlebek , it would be useful to include another column that describes the name of the format, e.g., ISO8601

| OTel Timestamp Format | Example |
|:---|:---|
| `%Y-%m-%d'T'%H:%M:%S*%f%z` | 2023-08-20'T'13:20:10*633+0000 |
| `%Y %b %d %H:%M:%S.%f %Z` | 2023 Mar 03 05:12:41.211 PDT |
| `%b %d %H:%M:%S %z %Y` | Jan 21 18:20:11 +0000 2023 |
| `%d/%b/%Y:%H:%M:%S %z` | 19/Apr/2023:06:36:15 -0700 |
| `%b %d, %Y %l:%M:%S %p` | Dec 2, 2023 2:39:58 AM |
| `%b %d %Y %H:%M:%S` | Jun 09 2023 15:28:14 |
| `%b %d %H:%M:%S %Y` | Apr 20 00:00:35 2010 |
| `%b %d %H:%M:%S %z` | Sep 28 19:00:00 +0000 |
| `%b %d %H:%M:%S` | Mar 16 08:12:04 |
| `%Y-%m-%dT%H:%M:%S%z` | 2023-10-14T22:11:20+0000 |
| `%Y-%m-%d %H:%M:%S %z` | 2023-08-19 12:17:55 -0400 |
| `%Y-%m-%d %H:%M:%S%z` | 2023-08-19 12:17:55-0400 |
| `%Y %b %d %H:%M:%S.%f*%Z` | 2023 Apr 13 22:08:13.211*PDT |
| `%Y %b %d %l:%M:%S` | 2023 Mar 10 1:44:20 |
| `%Y-%m-%d %H:%M:%S,%f%z` | 2023-03-10 14:30:12,655+0000 |
| `%Y-%m-%d %H:%M:%S` | 2023-02-27 15:35:20 |
| `%Y-%m-%d %H:%M:%S.%f%z` | 2023-03-12 13:11:34.222-0700 |
| `%Y-%m-%d'T'%H:%M:%S.%f` | 2023-07-22'T'16:28:55.444 |
| `%Y-%m-%d'T'%H:%M:%S` | 2023-09-08'T'03:13:10 |
| `%Y-%m-%d'T'%H:%M:%S'%z` | 2023-03-12'T'17:56:22'-0700' |
| `%Y-%m-%dT%H:%M:%S.%f%z` | 2023-11-22'T'10:10:15.455 |
| `%Y-%m-%d'T'%H:%M:%S` | 2023-02-11'T'18:31:44 |
| `%Y-%m-%d*%H:%M:%S:%f` | 2023-10-30*02:47:33:899 |
| `%Y-%m-%d*%H:%M:%S` | 2023-07-04*13:23:55 |
| `%y-%m-%d %H:%M:%S,%f %z` | 23-02-11 16:47:35,985 +0000 |
| `%y-%m-%d %H:%M:%S,%f` | 23-06-26 02:31:29,573 |
| `%y-%m-%d %H:%M:%S` | 23-04-19 12:00:17 |
| `%m/%d/%y %l:%M:%S` | 06/01/23 4:11:05 |
| `%m%d%y %H:%M:%S` | 220423 11:42:35 |
| `%Y%m%d %H:%M:%S.%f` | 20230423 11:42:35.173 |
| `%m/%d/%y*%H:%M:%S` | 08/10/23*13:33:56 |
| `%m/%d/%Y*%H:%M:%S` | 11/23/2023*05:13:11 |
| `%m/%d/%y %H:%M:%S %z` | 04/23/23 04:34:22 +0000 |
| `%m/%d/%Y %H:%M:%S %z` | 10/03/2023 07:29:46 -0700 |
| `%H:%M:%S` | 11:42:35 |
| `%H:%M:%S,%f` | 11:42:35,173 |
| `%d/%b/%Y:%H:%M:%S` | 23/Apr/2023:11:42:35 |
| `%d/%b%Y %H:%M:%S` | 23/Apr/2023 11:42:35 |
| `%d-%b-%Y %H:%M:%S` | 23-Apr-2023 11:42:35 |
| `%d-%b-%Y %H:%M:%S` | 23-Apr-2023 11:42:36 |
| `%d %b %Y %H:%M:%S` | 23 Apr 2023 11:42:35 |
| `%d %b %Y %H:%M:%S*%f` | 23 Apr 2023 10:32:35*311 |
| `%m%d_%H:%M:%S` | 0423_11:42:35 |
| `%m%d_%H:%M:%S.%f` | 0423_11:42:35.883 |
| `%q/%g/%Y %l:%M:%S %p:%f` | 8/5/2023 3:31:18 AM:234 |
| `%q/%d/%Y %I:%M:%S %p` | 9/28/2023 2:23:15 PM |

## Specifying a custom timestamp format

:::note Coming soon
Guidance on configuring custom timestamp formats using `strptime` directives for the OpenTelemetry Collector will be added shortly.
:::

### Timezones

:::note Coming soon
Details on time zone handling for the OpenTelemetry Collector are currently being finalized.
:::

## Time ranges

:::note Coming soon
Information about how the OpenTelemetry Collector handles time ranges is currently being finalized.
:::

## Date format

:::note Coming soon
Additional details about supported date formats for the OpenTelemetry Collector will be added shortly.
:::
4 changes: 4 additions & 0 deletions docs/send-data/reference-information/time-reference.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ We support several options for timestamps, time zones, time ranges, and dates. 

Because of the importance of timestamps, Sumo Logic indexes the timestamp of each message, making sure that data relevant to a query’s time range is returned properly in search results, which allows you to reconstruct a correct event timeline.

:::info
For details on timestamp and date formatting specific to the Sumo Logic OpenTelemetry (OTel) Collector, see [Timestamps, Time Zones, Time Ranges, and Date Formats for OpenTelemetry Collector](/docs/send-data/opentelemetry-collector/time-reference).
:::

## Timestamps

The timestamp is the part of a log message that marks the time that an event occurred. During ingestion, we can detect the message timestamp, convert it to Unix epoch time (the number of milliseconds since midnight, January 1, 1970 UTC), and index it. The timestamp is parsed either using the default timestamp parsing settings, or a custom format that you specify, including the time zone.
Expand Down
1 change: 1 addition & 0 deletions sidebars.ts
Original file line number Diff line number Diff line change
Expand Up @@ -294,6 +294,7 @@ module.exports = {
'send-data/opentelemetry-collector/auto-discovery',
'send-data/opentelemetry-collector/performance-benchmarks',
'send-data/opentelemetry-collector/data-transformations',
'send-data/opentelemetry-collector/time-reference',
'send-data/opentelemetry-collector/troubleshooting',
'send-data/opentelemetry-collector/sumo-logic-opentelemetry-vs-opentelemetry-upstream-relationship',
'send-data/opentelemetry-collector/faq',
Expand Down