Paste lines from different logs. Each timestamp is recognised — ISO, epoch, syslog, Apache — and rewritten as ISO 8601 in UTC, so the lines can be sorted into one timeline.
Runs entirely in your browser — nothing you enter here is sent to a server.
During an incident you pull lines from the web server, the application, the database and a queue worker, and try to see what happened first. Each of them writes time its own way. Nginx uses 12/Mar/2026:10:00:04 +0100. The application logs ISO 8601 in UTC. Syslog writes Mar 12 09:00:03 with no year and no zone. A worker logs Unix epoch seconds, and a Java service uses local time with a comma before the milliseconds.
Put side by side these cannot be sorted, and comparing them by eye is where mistakes happen — the classic one being an hour's offset that makes an effect appear to come before its cause. The normalizer finds the timestamp in each line, converts it to a single format in UTC and, if you want, sorts everything into one timeline.
2026-03-12T09:00:01.250Z or with a space and a comma. With an offset it is unambiguous; without one, the zone you select is used.
10 digits for seconds, 13 for milliseconds since 1970-01-01 UTC. Always UTC, never ambiguous, unreadable to humans.
12/Mar/2026:10:00:04 +0100 — the Common Log Format. Carries its own offset.
Mar 12 09:00:03 — no year, no zone. The current year and the selected zone are assumed.
The lasting fix is to log in one format everywhere: ISO 8601 (RFC 3339) in UTC with milliseconds. It sorts correctly as plain text, every tool parses it and there is nothing to assume. Keep server clocks synchronised with NTP as well — a normalised timestamp from a clock that is 40 seconds off is still wrong, and no tool can correct it afterwards.
ISO 8601 / RFC 3339 in UTC with millisecond precision, for example 2026-03-12T09:00:01.250Z. It is unambiguous, sorts lexically and is understood by every log tool.
It uses the zone you choose in "Timestamps without a zone are in". Timestamps that carry an offset or a Z, and Unix epochs, are converted exactly and ignore that setting.
Yes: a 10-digit number starting with 1 is read as seconds and a 13-digit number as milliseconds. Shorter or longer numbers are left alone so that ids and byte counts are not mistaken for times.
They are kept unchanged and, when sorting, placed at the end. Continuation lines of a stack trace are in this group, so sort only when each event is on one line.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.