[Q&A] How to handle year boundary with parsing timestamp.

[rightly]

Question

Description

When parsing timestamps for logs that don't include year information, there's a problem with year extraction at year boundaries, causing log insertion failures.

is there a way to specify timezone when using now() or when parsing timestamps?
(without changing the timestamp format of the original log)

Log timestamp examples

• ncdn: Nov 7 12:14:05.941 ...
• dns: Jan 5 14:45:39

Problem

• VictoriaLogs supports ISO8601/RFC3339 or unix timestamp formats
• Therefore, Jan 5 14:45:39 needs to be converted to RFC3339 format with year information
• At year boundaries, incorrect year values are extracted, causing log insertion failures

Root Cause

• now() returns UTC time, but the actual logs are in KST (UTC+9)
• During the period from 00:00 to 09:00 KST on January 1st, UTC time is still December 31st of the previous year
• This causes the year to be set to the previous year, resulting in timestamps that are too old and failing VictoriaLogs retention period validation

Vector Config

# timestamp conversion (Oct 28 17:27:46)
.year = format_timestamp!(now(), "%Y") # now() returns UTC time year
.log_timestamp = to_string(.year) + " " + to_string!(.logdate) # When combining this way, during +09:00Z 2026/01/01 00:00 ~ 09:00, year value returns 2025, which converts to 2024 when converted +09:00Z.
.timestamp, err = parse_timestamp(.log_timestamp, format: "%Y %b %d %H:%M:%S")
if err != null {
  log(err, level: "error")
}

Vector Logs

No response