Log Timestamp Normalizer

About this tool

Every service writes its timestamps differently. The app logs ISO-8601, the load balancer logs an Apache-style bracketed date, the container runtime logs raw epoch milliseconds and sshd logs a syslog stamp with no year and no timezone at all. Reading an incident across all of them means doing arithmetic in your head in four formats at once.

Paste the lines here and every timestamp comes back in one format and one timezone, with the elapsed time since the previous event written next to it. The detection runs per line, so a single paste can mix all of the formats above — you never have to tell the tool what the input looks like.

It runs as WebAssembly inside this page: your logs stay in the browser tab. There is no clock involved either — every instant comes out of the text you pasted, so the same paste always produces the same output.

A worked example

Paste this, leave every option alone:

2023-12-01T10:15:30Z INFO  boot: starting service
1701425735123 WARN  cache: miss for key user:42
Dec  1 10:16:20 web01 nginx: GET /health 200
01/Dec/2023:10:17:05 +0000 "GET /api/orders HTTP/1.1" 200
1701425830 INFO  boot: ready

You get back:

2023-12-01T10:15:30+00:00 INFO  boot: starting service  (start)
2023-12-01T10:15:35+00:00 WARN  cache: miss for key user:42  (+5.123s)
2023-12-01T10:16:20+00:00 web01 nginx: GET /health 200  (+44.877s)
2023-12-01T10:17:05+00:00 "GET /api/orders HTTP/1.1" 200  (+45s)
2023-12-01T10:17:10+00:00 INFO  boot: ready  (+5s)

Five lines, five different source formats, one output format. The syslog line on line 3 carries no year — it took 2023 from the dated lines around it. The (+44.877s) on that same line is the gap this tool exists to make visible.

Formats it detects

Each line is tried against the most specific pattern first, so an ISO stamp on a line that also contains a ten-digit request id is read as the stamp, not the id.

The epoch unit comes from the digit count, which is why an 11-digit number is not read as a timestamp: it is neither seconds nor milliseconds, so it is almost certainly an id.

The two things a log timestamp can be missing

A timezone. A bare 2023-12-01 10:15:30, an Apache stamp with no offset, and every syslog line carry a wall-clock time with nothing saying which wall. Set "Read zone-less timestamps as" to the zone the machine was configured for. Named zones are daylight-saving correct per timestamp, from the bundled IANA database: 2023-07-01 12:00:00 read as Europe/Berlin is 10:00 UTC, but 2023-12-01 12:00:00 is 11:00 UTC. Stamps that already carry a zone or an offset ignore this setting entirely.

A year. Syslog stamps have a month and a day and nothing else. Leave the year at 0 and it is inferred from the nearest line in the paste that does have one — trying that year, the one before and the one after, and keeping whichever lands closest in time, so a log that runs from December into January doesn't jump twelve months at the rollover. Set an explicit year between 1970 and 2100 when the paste is syslog-only, otherwise those lines stay unmatched.

Deltas and gaps

The delta annotation is the second half of the job. Each event gets the elapsed time since the previous one in parentheses — (+5.123s), with (start) on the first and a minus sign on any step that goes backwards in time. Set "Mark gaps at or above" to a number of seconds and every step at or over it gets GAP appended, which turns "find the slow step" into a text search. Turn on the summary header and you also get the format mix, the span from first to last event, the largest gap and the input line it falls on:

# 5 lines · 5 timestamps · 0 without one
# formats: apache 1, epoch-ms 1, epoch-s 1, iso-8601 1, syslog 1
# span: 2023-12-01T10:15:30+00:00 → 2023-12-01T10:17:10+00:00 (1m40s)
# largest gap: 45s at input line 4
# gaps at or above 30s: 2
# output: iso8601 in UTC

Limits and edge cases

• Up to 50,000 lines per run. A larger paste is refused rather than truncated.
• Lines with no timestamp — stack-trace frames, banners, wrapped JSON — are kept in place by default, and they stay attached to the event above them, so sorting can never tear a traceback away from its error.
• Bare 01/12/2023 dates are deliberately not detected. MM/DD and DD/MM are indistinguishable, and guessing wrong shifts an event by months without telling you.
• epoch_seconds and epoch_millis output is UTC by definition, so the output timezone has no effect on it.
• Only the first timestamp on a line is rewritten. A line carrying two stamps keeps the second one as it was written.

FAQ