How to use field name is "time" in record_transformers

[rhqudco]

Hello, I have a question.
Json The record_transformer filter is being used for data conversion.
If there is a field called "time", there is an issue that the field conversion value goes to null.
How are you guys converting the field "time"?

Below is an example of a setup file.

# conf file
<filter example.time>
  @type record_transformer
  enable_ruby true
  <record>
    timestamp ${record['time']}
    # ......omission......
  </record>
  remove_keys time, # ......omission......
</filter>

# output
{"timestamp ": null, ......omission......}

[rhqudco]

! update
I added 'keep_time_key true' by looking at the link below.
The desired parsing will occur, but the file name will have a date of 1970-01-01.

#4209

[rhqudco]

Info
fluentd 1.16.0
Ruby 3.0.4
Rocky OS 8

[daipom]

Could you share the config to reproduce it?

[rhqudco]

This is conf file

<source>
  @type tcp
  tag test.tcp
  <parse>
    @type json
    keep_time_key true
  </parse>
  port 5170
  bind 0.0.0.0
</source>

<filter test.**>
  @type record_transformer
  enable_ruby true
  <record>
    timestamp ${record['time']}
    device_id ${record['devid']}
    event_time ${record['evnetime']}
    srcip ${record['src']}
    dstip ${record['dst']}
  </record>
  remove_keys time, devid, evnetime, src, dst
</filter>

<match test.**>
  @type file
  path C:\\root\test
  flush_interval 3s
  append true
  path_suffix ".json"
  <format>
    @type json
  </format>
</match>

and

This is input Data

// This is test Data
{"time": "monday","devid": "a1234","evnetime": "07:01","src": "127.0.0.1","dst": "172.0.0.1"}

[daipom]

I see!
Json parser recognizes time key as the time for the event.
The data has value monday for the time key, so Json parser can't parse it as datetime.

If you want to use the current time for the time of the event, then you can set time_key nil to the parser.

<source>
  @type tcp
  tag test.tcp
  <parse>
    @type json
    keep_time_key true
    time_key nil
  </parse>
  port 5170
  bind 0.0.0.0
</source>

[rhqudco]

Thanks can I try on Monday and ask again?

Actually, the exact data format has not been decided because it is during PoC, so I think the actual "time" will contain data in the date format.

For example, I think data in the format yyyy-mm-dd hh:MM:ss will be included

[daipom]

I see!
You can set the format by time_format setting.
Please refer to this: https://docs.fluentd.org/parser/json#time_type

[rhqudco]

Thank you for your kindness.
I'll try it on Monday.
God bless you