Set Timestamp Processor
Description
This Processor will allow you to override an event's timestamp with a field and parser of your choice. You can set multiple fields and parsers, and it will utilize the first one that successfully parses.
Use
By default Mezmo Telemetry Pipelines set an event's .timestamp field to the time that the event was received. If your events already have a timestamp and you want to utilize that field for timestamp-related pipeline activities, you can use this Processor for that purpose.
Configuration
| Option | Description | Example |
|---|---|---|
| Field | The JSON field to parse. | .datetime |
| Timestamp Format | The strftime format your timestamp is stored as. There are several predefined timestamp formats. You can also choose Custom, and define one of your own. | %Y-%m-%dT%H:%M:%S |
Examples
Custom Event
If you have an event that stores its timestamp in a field called .datetime in a format like: 2022-01-10T05:15:40Z
Before
{ "level": "debug", "eventname": "test", "datetime": "2022-01-10T05:15:40Z"}This example affects only the .message portion of the event. The underlying event will also have .metadata and ``.timestamp`. ```You can use the Pipeline Tap feature to view these values for your source data.
Options
| Option | Value |
|---|---|
| Field | .datetime |
| Timestamp Format | %Y-%m-%dT%H:%M:%SZ |
After
(showing entire event, not just message)
{ "messgage": { "level": "debug", "eventname": "test", "datetime": "2022-01-10T05:15:40Z" }, "metadata": {}, "timestamp": "2022-01-10T05:15:40.000000000+00:00" }