Add option to disable timestamp adjustment in grok parser (#5488)
This commit is contained in:
@@ -110,6 +110,9 @@ you will find the https://grokdebug.herokuapp.com application quite useful!
|
||||
## 2. "Canada/Eastern" -- Unix TZ values like those found in https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
|
||||
## 3. UTC -- or blank/unspecified, will return timestamp in UTC
|
||||
grok_timezone = "Canada/Eastern"
|
||||
|
||||
## When grok_unique_timestamp is set to "disable", timestamp will not incremented if there is a duplicate. Default is "auto"
|
||||
# grok_unique_timestamp = "auto"
|
||||
```
|
||||
|
||||
#### Timestamp Examples
|
||||
|
||||
@@ -86,6 +86,9 @@ type Parser struct {
|
||||
Timezone string
|
||||
loc *time.Location
|
||||
|
||||
// UniqueTimestamp when set to "disable", timestamp will not incremented if there is a duplicate.
|
||||
UniqueTimestamp string
|
||||
|
||||
// typeMap is a map of patterns -> capture name -> modifier,
|
||||
// ie, {
|
||||
// "%{TESTLOG}":
|
||||
@@ -134,6 +137,10 @@ func (p *Parser) Compile() error {
|
||||
return err
|
||||
}
|
||||
|
||||
if p.UniqueTimestamp == "" {
|
||||
p.UniqueTimestamp = "auto"
|
||||
}
|
||||
|
||||
// Give Patterns fake names so that they can be treated as named
|
||||
// "custom patterns"
|
||||
p.NamedPatterns = make([]string, 0, len(p.Patterns))
|
||||
@@ -358,6 +365,10 @@ func (p *Parser) ParseLine(line string) (telegraf.Metric, error) {
|
||||
return nil, fmt.Errorf("grok: must have one or more fields")
|
||||
}
|
||||
|
||||
if p.UniqueTimestamp != "auto" {
|
||||
return metric.New(p.Measurement, tags, fields, timestamp)
|
||||
}
|
||||
|
||||
return metric.New(p.Measurement, tags, fields, p.tsModder.tsMod(timestamp))
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user