Skip to content

Commit 90e303b

Browse files
committed
Explain reserve_time with an execution result
Closes: #334 Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
1 parent 8ab0984 commit 90e303b

File tree

1 file changed

+51
-0
lines changed

1 file changed

+51
-0
lines changed

filter/parser.md

+51
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,57 @@ This parameter supports nested field access via [`record_accessor` syntax](../pl
7272

7373
Keeps the original event time in the parsed result.
7474

75+
```text
76+
<filter foo.bar>
77+
@type parser
78+
key_name log
79+
reserve_time true
80+
<parse>
81+
@type json
82+
</parse>
83+
</filter>
84+
```
85+
86+
With above configuration, here is the result:
87+
88+
```text
89+
# input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
90+
```
91+
92+
Above incoming event is parsed as:
93+
94+
```text
95+
time:
96+
2021-06-01 00:00:00.000000000 +0900
97+
98+
record:
99+
{
100+
"user": 1
101+
}
102+
```
103+
104+
The value of `time` field (`1622473200`) is reserved as event time (`2021-06-01 00:00:00.000000000 +0900`).
105+
106+
Without `reserve_time`, the result is:
107+
108+
```text
109+
# input data: {"key":"value","log":"{\"time\":1622473200,\"user\":1}"}
110+
```
111+
112+
Above incoming event is parsed as:
113+
114+
```text
115+
time:
116+
2021-06-24 14:33:35.475115751 +0900 (It vary on parsed timestamp)
117+
118+
record:
119+
{
120+
"user": 1
121+
}
122+
```
123+
124+
The value of parsed timestamp is set as event time. The value of `time` field is discarded.
125+
75126
### `reserve_data`
76127

77128
| type | default | version |

0 commit comments

Comments
 (0)