-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Checkpoint | support unix and unix_ms ts for time field #4781
Conversation
🌐 Coverage report
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Once the question is answered or fixed then we can merge
- convert: | ||
field: checkpoint.time | ||
type: long | ||
ignore_failure: true |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we really want ignore failure here? Is there no other if condition we can use?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Certainly, let me change 👍🏼
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removed the convert
and date
processors and written some painless to parse all 3 date formats. Let me know if that looks good.
Package checkpoint - 1.9.1 containing this change is available at https://epr.elastic.co/search?package=checkpoint |
What does this PR do?
Adds support for having
checkpoint.time
field asUNIX_MS
.Just adding
UNIX_MS
format to existing formats indate
processor here doesn't work as there is no check done on DateProcessor whether the value is seconds or milliseconds. This makes the currentdate
processor continues to matchUNIX
format even for millisecond epoch values.Alternate approach to check the number of digits of
checkpoint.time
is taken to resolve this issue.Checklist
changelog.yml
file.