Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions filter/parser.md
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,57 @@ This parameter supports nested field access via [`record_accessor` syntax](../pl

Keeps the original event time in the parsed result.

```text
<filter foo.bar>
@type parser
key_name log
reserve_time true
<parse>
@type json
</parse>
</filter>
```

With above configuration, here is the result:

```text
# input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
```

Above incoming event is parsed as:

```text
time:
2021-06-01 00:00:00.000000000 +0900

record:
{
"user": 1
}
```

The value of `time` field (`1622473200`) is reserved as event time (`2021-06-01 00:00:00.000000000 +0900`).

Without `reserve_time`, the result is:

```text
# input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
```

Above incoming event is parsed as:

```text
time:
2021-06-24 14:33:35.475115751 +0900 (It vary on parsed timestamp)

record:
{
"user": 1
}
```

The value of parsed timestamp is set as event time. The value of `time` field is discarded.

### `reserve_data`

| type | default | version |
Expand Down