Add option to disable timestamp adjustment in grok parser (#5488)

This commit is contained in:
Greg
2019-02-26 18:35:57 -07:00
committed by Daniel Nelson
parent ec746cc32a
commit 85617887c4
4 changed files with 30 additions and 5 deletions

View File

@@ -110,6 +110,9 @@ you will find the https://grokdebug.herokuapp.com application quite useful!
## 2. "Canada/Eastern" -- Unix TZ values like those found in https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
## 3. UTC -- or blank/unspecified, will return timestamp in UTC
grok_timezone = "Canada/Eastern"
## When grok_unique_timestamp is set to "disable", timestamp will not incremented if there is a duplicate. Default is "auto"
# grok_unique_timestamp = "auto"
```
#### Timestamp Examples

View File

@@ -86,6 +86,9 @@ type Parser struct {
Timezone string
loc *time.Location
// UniqueTimestamp when set to "disable", timestamp will not incremented if there is a duplicate.
UniqueTimestamp string
// typeMap is a map of patterns -> capture name -> modifier,
// ie, {
// "%{TESTLOG}":
@@ -134,6 +137,10 @@ func (p *Parser) Compile() error {
return err
}
if p.UniqueTimestamp == "" {
p.UniqueTimestamp = "auto"
}
// Give Patterns fake names so that they can be treated as named
// "custom patterns"
p.NamedPatterns = make([]string, 0, len(p.Patterns))
@@ -358,6 +365,10 @@ func (p *Parser) ParseLine(line string) (telegraf.Metric, error) {
return nil, fmt.Errorf("grok: must have one or more fields")
}
if p.UniqueTimestamp != "auto" {
return metric.New(p.Measurement, tags, fields, timestamp)
}
return metric.New(p.Measurement, tags, fields, p.tsModder.tsMod(timestamp))
}