title: Wrong event time in CloudWatch log events
body: <p>Found the solution after searching, but leaving this here if somebody happens to run into similar kind of confusion. See resolution in the end.</p>
  
  <p>I'm trying to figure out why AWS CloudWatch log service fails to understand the right timestamp for my log events. Currently all my events are being saved under Time 2017-01-01 no matter what the actual timestamp in the event is.</p>
  
  <p>I'm feeding the log from syslog where docker is saving the logged events and I configured docker to put the timestamp in format:</p>
  
  <pre><code>170105/103242 (%y%m%d/%H%M%S)
  </code></pre>
  
  <p>I configured awslogs service with parameters:</p>
  
  <pre><code>datetime_format = %y%m%d/%H%M%S
  </code></pre>
  
  <p>I restarted the service and hit the server, but still when I go to CloudWatch and see the log entries, even entries that indeed start with timestamp 170105/103242 are actually saved as events that belong to date 2017-01-01 containing all events between 01-01 and 01-05</p>
  
  <p>When I look at the awslogs.log I can see following lines:</p>
  
  <pre><code>2017-01-05 11:05:28,633 - cwlogs.push - INFO - 29223 - MainThread - Missing or invalid value for use_gzip_http_content_encoding config. Defaulting to using gzip encoding.
  2017-01-05 11:05:28,633 - cwlogs.push - INFO - 29223 - MainThread - Using default logging configuration.
  </code></pre>
  
  <p>This makes me think that the configuration probably isn't actually reading/using the datetime_format but I don't understand why it decides to end up using default. I tried to put </p>
  
  <pre><code>use_gzip_http_content_encoding = true
  </code></pre>
  
  <p>under general settings, but it doesn't change the errors.</p>
  
  <p>I am running out of ideas - has anyone managed to configure awslogger in a way where the datetime_format is actually used correctly?</p>
  
  <p>Edit:</p>
  
  <p>I'm currently hacking more console logs to local python2.7 push.py to see what is going on :)</p>
  
  <hr>
  
  <p>RESOLVED:</p>
  
  <p>Ok, problem was that I came into this project after the initial setup had been created and I had the impression that the logger was configured to use the .conf file in location:</p>
  
  <pre><code> /etc/awslogs/awslogs.conf 
  </code></pre>
  
  <p>that was dynamically populated.</p>
  
  <p>The environment had a script that gave this location to awslogs-agent-setup.py which tried to make the agent understand that configuration should be read from here.</p>
  
  <p>However this script didn't actually do what it was supposed to do and when the service started, it actually read the config from </p>
  
  <pre><code>/var/awslogs/etc/awslogs.conf
  </code></pre>
  
  <p>Which contained the default values. </p>
  
  <p>So the actual resolution was to change the datetime_format parameter in the default config and forget about the config I thought the service was using.</p>