When collecting logs through LogCollector, the log service defaults to using the time the log was collected by LogCollector as the log timestamp. If the application prints logs very quickly, or if LogCollector has fewer system resources allocated, LogCollector may delay the collection of logs due to a busy process, causing the log timestamp to be significantly later than the log generation time.

For example, the application prints the log at 8:00, but LogCollector collects the log at 8:10. By default, the log timestamp is 8:10, not 8:00. When the user retrieves the log, if the selected time range is 7:55 to 8:05, the log cannot be queried.

To avoid this problem, you can add a time field to the log format and define it as the time the log was generated. Turn off using acquisition time when creating an acquisition configuration. At this point, you need to fill in the time key name and time conversion format , you can see Step 3 Configure collection rule.

Last updated: 2026.06.25 17:01:03

Public security network record in Beijing: No. 11010802032137