1 Select the exact timestamp

The vertical markers define which characters LogoRRR reads from every log line.

2 Describe those characters

The time pattern tells LogoRRR what each year, month, day, hour, and fraction means.

Quick start

Open the timestamp settings for a log file.
Drag the Start and End markers until they contain only the timestamp.
Enter the matching time pattern, or press the dice button to ask LogoRRR for a proposal.
Review the selected text and proposed pattern, then choose Apply & Close.

Log line [INFO] 2026-08-31 10:31:47,576 Service started Pattern yyyy-MM-dd HH:mm:ss,SSS

The selection and pattern are a pair. If the selection contains a bracket, comma, space, or time-zone offset, the pattern must account for it. If the selection stops before a character, the pattern must stop there as well.

Common timestamp formats

These examples match formats LogoRRR can recognize and propose automatically.

Selected timestamp	Time pattern	Typical source
`2026-08-31 10:31:47`	`yyyy-MM-dd HH:mm:ss`	Application logs
`2026-08-31 10:31:47,576`	`yyyy-MM-dd HH:mm:ss,SSS`	Application logs with milliseconds
`2026-08-31T10:31:47.576+02:00`	`yyyy-MM-dd'T'HH:mm:ss.SSSXXX`	ISO-style timestamp with offset
`May 22 10:15:30`	`MMM dd HH:mm:ss`	Syslog-style timestamp
`[22/May/2026:10:15:30 +0200]`	`'['dd/MMM/yyyy:HH:mm:ss Z']'`	Web server access logs
`1779447330000`	`epoch_millis`	Unix epoch milliseconds
`1779447330`	`epoch_seconds`	Unix epoch seconds

Ambiguous numeric dates need your decision.

05/06/2026 can mean 5 June or May 6. Choose dd/MM/yyyy or MM/dd/yyyy according to the log producer.

Pattern letters

Pattern letters are case-sensitive. Repeating a letter usually controls the expected width or representation.

Pattern	Meaning	Example
`yyyy`	Four-digit year	`2026`
`MM`	Two-digit month	`08`
`MMM`	Short English month name	`Aug`
`dd`	Two-digit day of month	`31`
`HH`	Hour from 00 to 23	`10`
`hh`	Hour from 01 to 12; use with `a`	`10`
`mm`	Minute	`31`
`ss`	Second	`47`
`S`, `SSS`, …	Fraction of a second; match the digit count	`576`
`a`	AM/PM marker	`PM`
`XXX`	Offset with a colon or `Z`	`+02:00`
`Z`	Offset without a colon	`+0200`

Use punctuation such as -, /, :, ., ,, and spaces exactly where it appears. Quote literal letters and reserved characters with single quotes. The T in an ISO timestamp is written as 'T'; literal square brackets are written as '[' and ']'.

Fractions of a second

Use one S for every fractional digit present in the selected text:

Selected timestamp	Time pattern
`10:31:47.5`	`HH:mm:ss.S`
`10:31:47.576`	`HH:mm:ss.SSS`
`10:31:47.576123`	`HH:mm:ss.SSSSSS`
`10:31:47.576123000`	`HH:mm:ss.SSSSSSSSS`

The decimal separator belongs to the pattern. Use a dot for 47.576 and a comma for 47,576.

Missing dates and time zones

A timestamp with a date but no offset uses the computer’s current time zone.
A timestamp containing +02:00, Z, or another colon-separated offset should include XXX.
A compact offset such as +0200 should use Z.
A syslog-style timestamp without a year uses the current year.
A time-only timestamp uses the current local date.

For logs collected from several machines, include and select a time-zone offset whenever one is available. It removes ambiguity when LogoRRR orders events on a shared timeline or in a merged output.

Use the automatic proposal

The dice button is entirely opt in. When pressed, LogoRRR examines sample lines with its built-in deterministic rules and proposes both the column range and time pattern. It does not run automatically merely because the editor opened.

The proposal replaces the current draft in the editor. Review or adjust it, then choose Apply & Close to save it. Manual changes always remain possible.

The proposal is especially useful for ISO timestamps, application-log timestamps with fractional seconds, syslog timestamps, web server timestamps, and epoch values. Confirm ambiguous day/month order yourself.

Use the timeline

Once the settings parse valid timestamps, LogoRRR builds time labels and timeline activity in the background. Use the timeline to see bursts, gaps, and the current time range, then narrow the visible evidence without changing the source file.

Global timestamp defaults can initialize later files, while explicit per-file settings override those defaults.

Troubleshooting

The timeline stays empty

Check that the markers select the same timestamp characters on every line. A prefix with varying width can move the timestamp and make a fixed column range unreliable.

Some lines work and others do not

Compare the selected substring across several lines. Fractional seconds, optional offsets, missing leading zeroes, or inconsistent prefixes often explain partial parsing.

Month names do not parse

The pattern and source locale must agree. Prefer numeric months with MM when you control the log format.

The result is shifted by hours

If the timestamp contains an offset, select it and add XXX or Z. Without an offset, LogoRRR uses the computer’s current time zone.

The proposed range is close but not exact

Drag either marker to correct the selection, update the pattern when necessary, and apply the reviewed values.