How to set old time in TimeGenerated field when we ingest data using HTTP Data Collector API?




As per this article (


The name of a field in the data that contains the timestamp of the data item. If you specify a field then its contents are used for TimeGenerated. If this field isn’t specified, the default for TimeGenerated is the time that the message is ingested. The contents of the message field should follow the ISO 8601 format YYYY-MM-DDThh:mm:ssZ.


But, when I set TimeGenerated as my Datetime field in json data, I get 200 as response. However, I do not see the data getting populated in LogAnalytics.


Has anyone set old time in TimeGenerated using this API?

2 Replies
best response confirmed by Vino55 (Microsoft)


The documentation is correct. You can set old time but also the time shouldn't be beyond the retention time of your Log Analytics workspace. For example if you retention is 30 days and you log a time 60 days ago the data will not appear as it will figure out that is too old. Also when you log time for example that is 2 weeks old when you use the Logs blade you will have to change the time frame so it fits to the time you logged.

I'd like to add my frustration: I've hit this bug and this post nursed me to sanity. If message is _not_ going to be accepted, 200 status code should _NOT_ be returned.