It appears that %6N time format option is not supported by time_format

[portante]

Given a timestamp value of 2015-09-26T12:12:08.358897+00:00, it appears that using %6N in a time_format string does not work, while %L does work. Is this expected?

Our fluentd config:

<source>
    type tcp
    port 4001
    bind 0.0.0.0
    tag tcp.rsyslog
    format json
    time_key @timestamp
    time_format %Y-%m-%dT%H:%M:%S.%6N%z
    # does work
    # time_format %Y-%m-%dT%H:%M:%S.%L%z
    source_host_key clienthostname
</source>

<match **>
    type stdout
    output_type json
</match>

An example JSON payload:

{"@timestamp":"2015-09-26T12:14:53.658207+00:00","@version":"2015.09.24-0","message":"action 'action 9' resumed (module 'builtin:omfwd') [v8.8.0 try http:\/\/www.rsyslog.com\/e\/2359 ]","hostname":"gandalf.example.com","level":"info","pid":"-","rsyslog": {"facility":"syslog","programname":"rsyslogd-2359","fromhost":"gandalf.example.com","fromhost-ip":"127.0.0.1","timegenerated":"2015-09-26T12:14:53.658207+00:00","protocol-version":"0","structured-data":"-","app-name":"rsyslogd-2359","msgid":"-","inputname":"rsyslogd"} }

Example error:

2015-09-26 12:14:53 +0000 fluent.error: {"error":"#<Fluent::ParserError: invalid time format: value = 2015-09-26T12:14:53.658207+00:00, error_class = ArgumentError, error = invalid strptime format - `%Y-%m-%dT%H:%M:%S.%6N%z'>","error_class":"Fluent::ParserError","host":"10.18.80.2","message":"\"{\\\"@timestamp\\\":\\\"2015-09-26T12:14:53.658207+00:00\\\",\\\"@version\\\":\\\"2015.09.24-0\\\",\\\"message\\\":\\\"action 'action 9' resumed (module 'builtin:omfwd') [v8.8.0 try http:\\\\/\\\\/www.rsyslog.com\\\\/e\\\\/2359 ]\\\",\\\"hostname\\\":\\\"gandalf.example.com\\\",\\\"level\\\":\\\"info\\\",\\\"pid\\\":\\\"-\\\",\\\"rsyslog\\\": {\\\"facility\\\":\\\"syslog\\\",\\\"programname\\\":\\\"rsyslogd-2359\\\",\\\"fromhost\\\":\\\"gandalf.example.com\\\",\\\"fromhost-ip\\\":\\\"127.0.0.1\\\",\\\"timegenerated\\\":\\\"2015-09-26T12:14:53.658207+00:00\\\",\\\"protocol-version\\\":\\\"0\\\",\\\"structured-data\\\":\\\"-\\\",\\\"app-name\\\":\\\"rsyslogd-2359\\\",\\\"msgid\\\":\\\"-\\\",\\\"inputname\\\":\\\"rsyslogd\\\"} }\" error=#<Fluent::ParserError: invalid time format: value = 2015-09-26T12:14:53.658207+00:00, error_class = ArgumentError, error = invalid strptime format - `%Y-%m-%dT%H:%M:%S.%6N%z'> error_class=Fluent::ParserError host=\"10.18.80.2\""}

[repeatedly]

It is a Ruby's limitation. Here is an issue on Ruby Core in japanese.

https://bugs.ruby-lang.org/issues/11220

You can use %N or %L so it seems not a critical problem.

irb(main):005:0> Time.strptime('2015-09-26T12:14:53.658207+00:00', '%Y-%m-%dT%H:%M:%S.%N%z').nsec
=> 658207000
irb(main):006:0> Time.strptime('2015-09-26T12:14:53.658207+00:00', '%Y-%m-%dT%H:%M:%S.%L%z').nsec
=> 658207000