loki.process stage.timestamp – not rewriting the timestamp

[maxxieb]

What's wrong?

Hi folks! I’ve got some issues with processing logs with Alloy before forwarding it to Loki.

And it seems like a bug. I've asked about it already on the community forum, but since the config is valid, the timestamp is valid as well, I think that all is good on my side and might be a bug on Alloy's end.

Steps to reproduce

1. Use stage.timestamp with RFFC3339

System information

Linux 6.6.66 x86_64 GNU/Linux

Software version

alloy:v1.5.1

Configuration

local.file_match "tacho_json" {
	path_targets = [
		{__path__ = "/tmp/tacho.json"},
	]
}

loki.source.file "tacho_json" {
	targets    = local.file_match.tacho_json.targets
	forward_to = [loki.process.parse_json.receiver]
}

loki.process "parse_json" {
	forward_to = [loki.write.default.receiver]

	stage.match {
		selector = "{record_type=\"1\"}"

		stage.json {
			expressions = {timestamp = "", work_type = "", record_type = "", drive_present = "", card_present = "", team = ""}
		}

		stage.timestamp {
			source = "timestamp"
			format = "RFC3339"
		}
	}
}

loki.write "default" {
	endpoint {
		url     = "http://loki-gateway.o11y/loki/api/v1/push"
		headers = {
			"X-Scope-OrgID" = "1",
		}
	}
}

Logs

{"level":"info","record_type":1,"card_present":true,"driver_present":false,"team":false,"work_type":0,"timestamp":"2024-09-23T00:00:00Z","time":"2025-01-10T17:45:45+01:00"}