CloudWatch Log Events Actions "Download search results (CSV)" - issue with downloaded file's format for the "Time Stamp" column in the CSV

Question

Hi re:Post Support!

CloudWatch > Log Events > Actions > "Download search results (CSV)" - issue with downloaded file's format for the "Timestamp" column in the CSV. (Green Square in screenshot below)

On screen the Timestamp is in this format (Orange Square in screenshot below):

2024-03-27T08:30:51.000-04:00

![Enter image description here](/media/postImages/original/IM5WvfXneUSR-sixx77Zc8SA)
--
But after downloading via "Download search results (CSV)" the format changes to (Red squares in screenshot below):

1711542651000

![Enter image description here](/media/postImages/original/IMZAgKdY6BTKaLu1av2MgQOA)

------------------------------

What is going on?
How can I get the download file to write "2024-03-27T08:30:51.000-04:00" instead of "1711542651000" for each occurrence of Timestamp ?

Thank you for your time!
Best Regards,
Donald

Accepted Answer

Hello,

When logs are downloaded from CloudWatch as CSV, the timestamp format is standardized to milliseconds since the Unix epoch (January 1, 1970, 00:00:00 UTC) for consistency.

This standardized timestamp format is used regardless of the original timestamp format in the logs when they were ingested into CloudWatch Logs. The reason for this is that CSV is a flat file format that works best with a uniform timestamp format across all log events.

CloudWatch > Log Events > Actions > "Download search results (CSV)" - issue with downloaded file's format for the "Time Stamp" column in the CSV

Relevant content