Add --timestamp and --ingested-time options

[vlcinsky]

Current version 0.2.0 allow printing log records, but does not allow printing ingestedTime and timestamp in separate columns.

When is printing timestamp and ingestedTime relevant

In many cases, log records do contain timestamp of the record as part of it's text, but there are good reasons to show ingestedTime and timestamp as recorded by AWS for following reasons:

• log records do not have to contain any information about timestamp
• the time reported by log record might be wrong (e.g. due to not synced time on the computer it was generated)
• sometime it can be practical to compare timestamp as reported by log record and as parsed by AWS plus time it was ingested.

Proposed behaviour

By default, no timestamp and ingestedTime columns are printed.

Add options --timestamp and --ingested-time. If used, timestamp and ingestedTime columns are printed.

The order of columns shall be:

• group
• stream
• timestamp
• ingestedTime
• log record text

This order has the advantage, that columns with predictable width and delimiters are printed first and variable length part comes at the end. It shall simplify processing of the awslogs output by other tools.

Both times shall be expressed in RFC3339 format in UTC, this shall ensure, the output is not dependent on where is the command run. As both times are expressed with miliseconds, the datetime might look like 2016-01-19T22:03:36.123Z

Conclusions

There exists PR #26, which is getting close, but would have to be modified to meet the requirements mentioned above, namely:

• allow output of ingestedTime

[vlcinsky]

PR #36 shall resolve this issue

[jorgebastida]

Merged! Thanks