File tree 1 file changed +51
-0
lines changed
1 file changed +51
-0
lines changed Original file line number Diff line number Diff line change @@ -72,6 +72,57 @@ This parameter supports nested field access via [`record_accessor` syntax](../pl
72
72
73
73
Keeps the original event time in the parsed result.
74
74
75
+ ``` text
76
+ <filter foo.bar>
77
+ @type parser
78
+ key_name log
79
+ reserve_time true
80
+ <parse>
81
+ @type json
82
+ </parse>
83
+ </filter>
84
+ ```
85
+
86
+ With above configuration, here is the result:
87
+
88
+ ``` text
89
+ # input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
90
+ ```
91
+
92
+ Above incoming event is parsed as:
93
+
94
+ ``` text
95
+ time:
96
+ 2021-06-01 00:00:00.000000000 +0900
97
+
98
+ record:
99
+ {
100
+ "user": 1
101
+ }
102
+ ```
103
+
104
+ The value of ` time ` field (` 1622473200 ` ) is reserved as event time (` 2021-06-01 00:00:00.000000000 +0900 ` ).
105
+
106
+ Without ` reserve_time ` , the result is:
107
+
108
+ ``` text
109
+ # input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
110
+ ```
111
+
112
+ Above incoming event is parsed as:
113
+
114
+ ``` text
115
+ time:
116
+ 2021-06-24 14:33:35.475115751 +0900 (It vary on parsed timestamp)
117
+
118
+ record:
119
+ {
120
+ "user": 1
121
+ }
122
+ ```
123
+
124
+ The value of parsed timestamp is set as event time. The value of ` time ` field is discarded.
125
+
75
126
### ` reserve_data `
76
127
77
128
| type | default | version |
You can’t perform that action at this time.
0 commit comments