Error spam when log lines don't have timestamp #5476
Description
Component(s)
loki.source.docker
What's wrong?
When log lines don't have timestamps, Alloy spams these errors in the logs
ts=2026-02-07T00:00:57.058971127Z level=error msg="could not extract timestamp, skipping line" component_path=/ component_id=loki.source.docker.docker component=tailer container=docker/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379 err="could not find timestamp in bytes"
ts=2026-02-07T00:05:57.000351413Z level=error msg="could not extract timestamp, skipping line" component_path=/ component_id=loki.source.docker.docker component=tailer container=docker/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379 err="could not find timestamp in bytes"
This is the container logging config:
root@server: docker inspect 394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379 | grep LogConfig -A 5
"LogConfig": {
"Type": "json-file",
"Config": {
"max-file": "1",
"max-size": "10m"
}And this is the log section of cloudflare-ddns logs where alloy identifies 2 errors:
root@server: cat /var/lib/docker/containers/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379-json.log
{"log":"⏰ Checking the IP addresses in about 5m0s . . .\n","stream":"stdout","time":"2026-02-07T00:00:57.096987739Z"}
{"log":"\n","stream":"stdout","time":"2026-02-07T00:05:57.000219004Z"}
{"log":"🌐 Detected the IPv4 address <ip>\n","stream":"stdout","time":"2026-02-07T00:05:57.035619032Z"}
{"log":"🤷 The A records of <domain> are already up to date (cached)\n","stream":"stdout","time":"2026-02-07T00:05:57.035631766Z"}
{"log":"⏰ Checking the IP addresses in about 5m0s . . .\n","stream":"stdout","time":"2026-02-07T00:05:57.035711966Z"}
{"log":"\n","stream":"stdout","time":"2026-02-07T00:10:57.000158137Z"}Looks like it doesn't like the empty logs with \n. It does appear to drop those empty logs and in Grafana I do not see those newline logs (which is fine). However, this feels like maybe a warning or even debug since nothing failed. I would expect an alloy error to be something fatal like a host it can't connect to or permissions error with loki.source.file.
In the above container logs, the other log's don't have time info either and alloy keeps those and doesn't say anything about them. Alloy does have the time info available when containers use json logging like above and I feel like it should be using that as a fallback (or when it was parsed) if log doesn't have a timestamp in the log line.
So is it expected to call those errors and is the error message correct based on the logic in the alloy code? I find it peculiar that loki.source.docker would drop anything that isn't a fatal issue. Plus, not every container logs time, so the behavior here feels like error noise that will mask more serious issues.
Steps to reproduce
I haven't created an MWE, but I think just spinning up a container that periodically echo's \n and other messages without timestamps to docker should trigger this.
System information
docker grafana/alloy:v1.13.0
Software version
Grafana Alloy 1.13.0
Configuration
loki.write "default" {
endpoint {
url = "http://loki:3100/loki/api/v1/push"
batch_wait = "5s"
}
external_labels = {}
}
discovery.docker "logs_docker" {
host = "unix:///var/run/docker.sock"
}
discovery.relabel "logs_docker" {
targets = []
rule {
source_labels = ["__meta_docker_container_name"]
regex = "/(.*)"
target_label = "container"
}
rule {
target_label = "instance"
replacement = constants.hostname
}
}
loki.source.docker "docker" {
host = "unix:///var/run/docker.sock"
targets = discovery.docker.logs_docker.targets
relabel_rules = discovery.relabel.logs_docker.rules
refresh_interval = "30s"
labels = {
job = "docker-logs",
platform = "docker",
}
forward_to = [loki.process.docker.receiver]
}
loki.process "docker" {
stage.decolorize {}
forward_to = [loki.write.default.receiver]
}
Logs
ts=2026-02-07T00:00:57.058971127Z level=error msg="could not extract timestamp, skipping line" component_path=/ component_id=loki.source.docker.docker component=tailer container=docker/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379 err="could not find timestamp in bytes"
ts=2026-02-07T00:05:57.000351413Z level=error msg="could not extract timestamp, skipping line" component_path=/ component_id=loki.source.docker.docker component=tailer container=docker/394abfe76d39f50e30341f2911cd42a95449bf74567626e7809fcd63f04e2379 err="could not find timestamp in bytes"
Tip
React with 👍 if this issue is important to you.