I'm trying to parse some logs with Promtail but I've got a problem with the timestamp. Promtail expects a dot (.) like a separator for milliseconds but my logs use colons (:). Let me explain it with examples:
- Expected timestamp format: 2/1/06 15:04:05.000
- Actual log timestamp value: 9/8/22 9:04:35:036
I'd like to replace the last colons with a dot in order to get this value 9/8/22 9:04:35.036 and to be able to parse it. To do so, I've tried to use a Promtail template like this:
- template:
source: time
template: '{{ Replace .Value ":" "." 1 }}'
- timestamp:
source: time
format: "2/1/06 15:04:05.000"
However, with this replacement I change the first colons and I get this value 9/8/22 9.04:35:036.
Does somebody know how to replace the last colons?
Thanks in advance.
