Repository navigation
timestamp_format is ignored #2000
Description
Describe the bug
Given standard high-precision syslog format and config: "timestamp_format": "%Y-%m-%dT%H:%M:%S.%f+00:00" and "trim_timestamp": true, the timestamp in CloudWatch Logs differs from the timestamp in the log message, and the timestamp isn't trimmed.
Steps to reproduce
{
"file_path": "/var/log/syslog",
"log_group_class": "STANDARD",
"log_group_name": "syslog",
"log_stream_name": "{instance_id}",
"retention_in_days": 30,
"timestamp_format": "%Y-%m-%dT%H:%M:%S.%f+00:00",
"trim_timestamp": true
},
What did you expect to see?
No timestamp in the Message field and the correct timestamp in the Timestamp field
What did you see instead?
The correct timestamp in the Message field, and an incorrect timestamp in the Timestamp field
What version did you use?
CWAgent/1.300064.0b1337 (go1.25.5; linux; arm64)
What config did you use?
As above
Environment
Ubuntu 24.04.2 LTS
Additional context
Activity
davidjmemmett commentedon Feb 4, 2026
To confirm, I ensured that the time format is correct, as per the docs and the standard strptime/strftime functions:
davidjmemmett commentedon Feb 4, 2026
The generated TOML config file contains the following lines, which appears to miss the dot before the high-precision timestamp in the
timestamp_regex:davidjmemmett commentedon Feb 4, 2026
After some messing about, I've tweaked the expression in RegEx101 in order to make it match: https://regex101.com/r/QI1Xe8/1
The new expression:
(\d{4}-\s{0,1}\d{1,2}-\s{0,1}\d{1,2}T\d{2}:\d{2}:\d{2}\.(\d{1,9})\+00:00)So I believe the original expression is missing the
\.between the seconds and the microseconds, as well as escaping on the\+before the hard-coded timezone.varunch77 commentedon Feb 6, 2026
Hi David, thanks for deep diving on this issue and bringing this to our attention. I will bring this up to my team for further discussion.
jefchien commentedon Feb 9, 2026
Tested the configuration and it gets generated with the escaped
.. The issue is that the agent doesn't escape the+.davidjmemmett commentedon Feb 12, 2026
Hi @jefchien @varunch77 ,
I've got AWS CloudWatch Agent installed via a AWS EC2 ImageBuilder recipe - is there an easy way for me to update it to an alpha build containing this fix to verify?
Cheers,
David
davidjmemmett commentedon Feb 20, 2026
Any progress @jefchien @varunch77 ?
jefchien commentedon Mar 19, 2026
Hi @davidjmemmett,
Sorry for the delay (need to look at GitHub notifications more). We don't have an alpha build that is publicly available. How do you install the CloudWatch agent in your ImageBuilder recipe? Is it from S3 or the Amazon Linux yum repos?
davidjmemmett commentedon Mar 19, 2026
It's AWS' recipe & it's on Ubuntu, so I've no idea what it does under the hood.
jefchien commentedon Mar 19, 2026
Took a look at the EC2 Image builder component (
amazon-cloudwatch-agent-linux). Looks like it downloads the CloudWatch agent from the regional S3 bucket.davidjmemmett commentedon Mar 20, 2026
I'm just including the component ARN:
arn:aws:imagebuilder:eu-west-2:aws:component/amazon-cloudwatch-agent-linux/1.0.1/1davidjmemmett commentedon Mar 24, 2026
Hi @jefchien,
Any idea when I can use a newer build?
jefchien commentedon Apr 2, 2026
Hi @davidjmemmett,
The CloudWatch Agent follows a regular release cycle. You can check the release tags (https://github.com/aws/amazon-cloudwatch-agent/tags) to confirm which release includes the fix.
Once a release is built, it is rolled out progressively across all distribution channels (S3, SSM, container images, Amazon Linux repos, EKS add-on, etc.), which can take several weeks to complete across all regions and channels. This means there can be a gap between when a release is tagged and when updated artifacts are available.
We don't publish fixed timelines for individual patches.
davidjmemmett commentedon Apr 7, 2026
Hi,
I tested the version released last night and it doesn't seem to have resolved the issue...
CWAgent/1.300064.1b1344 (go1.25.6; linux; arm64)Cheers,
David
jefchien commentedon Apr 9, 2026
The fix you're looking for 9a85a39 is part of
v1.300065.0+as shown by the tags. Those versions are not available yet.jefchien commentedon Apr 22, 2026
@davidjmemmett The fix has been released as part of v1.300066.1.
davidjmemmett commentedon Apr 24, 2026
Hi @jefchien I have installed AmazonCloudWatchAgent CWAgent/1.300066.1b1374 and now it's not sending any logs to CloudWatch at all. There's nothing in
/var/log/amazon/amazon-cloudwatch-agent/amazon-cloudwatch-agent.logsuggesting any issues either.davidjmemmett commentedon Apr 24, 2026
Ignore this, I found some troubleshooting in the AWS docs and it seems to be working. I'll keep testing and close this issue when I have verified that everything is working as expected.
Thanks for your help.