VictoriaLogs Practical Ingestion Guide for Message, Time and Streams

Summary

VictoriaLogs Practical Ingestion Guide for Message, Time and StreamsThis VictoriaLogs article serves as a quick way to grasp the core concepts of VictoriaLogs. It covers only the most important information from the documentation, along with common cases identified after troubleshooting many real-world scenarios.If you’re just getting started with VictoriaLogs, this is a great place to begin. For more in-depth or advanced details, refer to the official documentation.VictoriaLogs Concepts#Message and Time#VictoriaLogs can receive both structured logs and unstructured logs. Let’s say you’re sending these unstructured logs:127.0.0.1 - frank [28/Jul/2025:10:12:07 +0000] "GET /apache.gif HTTP/1.0" 200 2326 Jul 28 10:12:04 web-01 sshd[987]: Accepted publickey for root from 192.0.2.7 port 51122 ssh2 2025-07-28 10:15:09,123 ERROR main MyApp - java.lang.NullPointerException: Foo.bar(Foo.java:42) None of these lines have been broken into an obvious set of key-value pairs, so in logging terms, they are “unstructured.”VictoriaLogs turns the first log into structured logs that look like this:{ "_msg": "127.0.0.1 - frank [28/Jul/2025:10:12:07 +0000] \"GET /apache.gif HTTP/1.0\" 200 2326", "_time": "2025-07-28T10:12:07Z" } VictoriaLogs has three important concepts: message, time, and stream. We’ve just covered two of these concepts.Every log entry must include at least the _msg field, which contains a human-readable string describing the event.VictoriaLogs natively supports this field, and it works out of the box:You can run simple queries without specifying the field name.The Web UI automatically displays the _msg field for quick troubleshooting, instead of the full log line, which can be long and hard to read.You can expand the log to view the full JSON. All other fields attached to the message are metadata that help users interpret the event.If the _time field is not specified in the log message, VictoriaLogs will use the log ingestion time instead.Stream#A stream in VictoriaLog...