How to read a Unix timestamp in a log file

Application logs, web server access logs, and cloud audit trails often record events as Unix timestamps for compactness and precision. During an incident, quickly reading those timestamps without mental arithmetic is essential. This guide shows how to convert log timestamps to readable UTC dates in seconds.

Step-by-step guide

1. Find the timestamp in the log entry: Look for a 10-digit integer (seconds) or 13-digit integer (milliseconds) near the start of a log line. In Nginx access logs it appears as a float like 1716998400.123 — use the integer part. In structured JSON logs, it may be a field like 'timestamp' or 'time'.
2. Paste and convert: Paste the integer timestamp into the converter. The ISO 8601 UTC string and the relative time appear immediately. For high-volume log analysis, use the REST API: POST /api/timestamp-converter with the timestamp in the 'input' field.
3. Cross-reference with other events: Convert timestamps from multiple log entries to identify the sequence of events during an incident. The relative time field ('3 minutes before the deploy' vs 'during the spike') helps you narrate the incident timeline without converting every entry manually.

Frequently asked questions

My log timestamp has a decimal — what does the fractional part mean?

Fractional seconds — for example 1716998400.456 means 456 milliseconds past the second. Use the integer part (1716998400) for second-level precision, or multiply the full float by 1000 and truncate to get milliseconds (1716998400456).

Can I convert timestamps in bulk?

Use the REST API in a shell loop: for ts in 1716998400 1716998401 1716998402; do curl -s -X POST https://quickhelp.dev/api/timestamp-converter -H 'Content-Type: application/json' -d "{\"input\":\"$ts\"}" | jq .iso8601; done