Lesson 4

ISO 8601 and Log Time Formats

Reading `Z` suffixes, offsets like `+08:00`, and mixed log line styles.

ISO 8601 is the most common textual format for datetimes in modern APIs and configs. Logs often mix ISO, epoch integers, and locale-specific strings in the same file.

ISO 8601 building blocks

2024-03-15T14:30:00Z          # UTC
2024-03-15T14:30:00+08:00     # Fixed offset from UTC
2024-03-15T14:30:00.123Z      # Fractional seconds

T separates date and time
Z or numeric offset makes the instant unambiguous
Omitting offset and timezone context invites bugs

RFC 2822 / email-style strings

You may see:

Mon, 15 Mar 2024 14:30:00 +0000

These include weekday names and month abbreviations. Parsers exist in most languages, but they are less uniform than ISO—validate carefully.

Log line patterns

Typical combinations:

Style	Example	Notes
Epoch seconds	`1700000000`	Compact, needs conversion for humans
ISO UTC	`2023-11-14T22:13:20Z`	Self-describing
Local + offset	`2023-11-15 06:13:20 +0800`	Common in app logs
Space-separated	`2023-11-14 22:13:20`	Ambiguous without timezone

When grepping logs, extract the numeric or ISO portion before parsing—prefix text (INFO, trace IDs) is not part of the datetime.

Key takeaway

Prefer ISO with explicit Z or offset in new systems. When ingesting legacy logs, identify the format per field before converting to epoch for correlation.

← Back to course overview