Symptom
Logs appear delayed due to _timestamp not matching expected log time according to date/time values in _raw. Instead of expected date/time and epoch timestamp within _raw is picked up. For example: 2026-03-12,18:23:48 (comma is the issue).
Environment
- Cribl Stream
Resolution
To resolve this issue, you have three options:
- Create a custom timestamp regex in a custom breaker to extract the correct values and apply that to the source (if available).
- Create a pipeline eval function to replace the auto-extracted _timestamp with the correct values.
- Modify the log output at the sender to combine date/time into an accepted value.
Cause
This issue occurs because the format of log date/time does not match the auto-matched formats as defined in cribl/src/sluice/js/public/Time.ts. If the correct timestamp isn’t matched but a matching timestamp format is found later in the event, that will get picked up instead.
const DATES = [
'%Y-%m-%d', // 2018-12-26
'%Y/%m/%d', // 2018/12/26
'%m-%d-%Y', // 12-26-2018
'%m/%d/%Y', // 12/26/2018
'%d/%b/%Y', // 26/Dec/2018
'%d-%b-%Y', // 26-Dec-2018
// partial year
'%m/%d/%y', // 12/26/18
'%m-%d-%y', // 12-26-18
'%b %d %Y', // Dec 26 2018
'%b %d %Y', // Dec 6 2018
'%b %d, %Y', // Dec 26, 2018
'%b %d, %Y', // Dec 6, 2018
'%a %b %d %Y', // Wed Dec 26 2018
'%a %b %d %Y', // Wed Dec 6 2018
// missing year info
'%a %b %d', // Wed Dec 26
'%a %b %d', // Wed Dec 6
'%b %d', // Dec 26
'%b %d', // Dec 6
// k8s dates: https://github.com/kubernetes/klog/blob/master/klog.go#L111
'I%m%d',
'W%m%d',
'E%m%d',
'F%m%d',
];
const TIMES = [
'%H:%M:%S.%f', // 09:56:01.333333
'%H:%M:%S.%L', // 09:56:01.333
'%H:%M:%S,%f', // 09:56:01,333333
'%H:%M:%S,%L', // 09:56:01,333
'%I:%M:%S %p', // 09:56:01 PM
'%H:%M:%S %Y', // 09:56:01 2019, as in Mon Jan 21 17:35:56 2019
'%H:%M:%S %Z %Y', // 09:56:01 UTC 2019, as in Mon Jan 21 17:35:56 UTC 2019
'%H:%M:%S', // 09:56:01
];