CODEWITHSUNDEEP
loggingtimetimestampdatadog
Pypynio
Pypynio

Reputation: 1

Logs Delayed by One Hour DataDog

I'm experiencing a problem with logs collected by Datadog where some logs appear with a one-hour delay. The affected logs have a timestamp format such as: 2025-02-03 17:35:09.913 The timestamps do not include timezone information (UTC+1), so Datadog interprets them as being in UTC. As a result, at 2 am logs with timestamp 1am appear in the log content.

Unfortunately, I do not have the ability to modify the log format from the application side.

Is there any way to correct this issue through the Datadog UI or any other configuration so that the timestamps are interpreted correctly with the appropriate timezone, thus allowing the logs to appear in real-time?

Upvotes: 0

Views: 76

Answers (1)

Greg
Greg

Reputation: 1599

In order to modify the timestamp in Datadog you will first need to configure a Pipeline that filters logs from this specific source, and add a Grok Processor and Date Remapper to the Pipeline to match the raw logs and append the intended timezone.

For example, following this guide on parsing raw logs let's look at a log example without a timezone specified:

2025-02-03 11:01:03 | INFO | (tagger.go:80 in Init) | starting the tagging system

To parse this with the correct timezone, create a Grok Parser to match this log, and add a parsing rule that includes the server's timezone (UTC+1). The parsing rule for the above example will look like the following:

MyParsingRule %{date("yyyy-MM-dd HH:mm:ss z", "UTC+1"):date} \| %{word:severity} \| \(%{notSpace:logger.name}:%{integer:logger.line}[^)]*\) \|.*

Next, add a Date Remapper just after the Grok Parser within the same Pipeline. This will update the official date that displays at the top of each log. Following the example above you will need to set the Date Remapper attribute to date.

This Datadog documentation includes more details on parsing log timestamps with timezones.

If you do need more assistance with configuring a Pipeline or Processor within your Datadog account, I encourage you to reach out to the Support Team for assistance walking through this process:

https://docs.datadoghq.com/help/

Upvotes: 1

Related Questions