Add millisecond unix time support to grok parser (#6476)

This commit is contained in:
Rajiv Kushwaha
2019-10-05 06:08:48 +05:30
committed by Daniel Nelson
parent ddd79762ac
commit b9a4ef7484
7 changed files with 79 additions and 6 deletions

View File

@@ -105,6 +105,7 @@ Patterns that convert all captures to tags will result in points that can't be w
- ts-rfc3339nano ("2006-01-02T15:04:05.999999999Z07:00")
- ts-httpd ("02/Jan/2006:15:04:05 -0700")
- ts-epoch (seconds since unix epoch, may contain decimal)
- ts-epochmilli (milliseconds since unix epoch, may contain decimal)
- ts-epochnano (nanoseconds since unix epoch)
- ts-syslog ("Jan 02 15:04:05", parsed time is set to the current year)
- ts-"CUSTOM"

View File

@@ -48,7 +48,7 @@ func TestGrokParseLogFiles(t *testing.T) {
Log: testutil.Logger{},
GrokConfig: GrokConfig{
MeasurementName: "logparser_grok",
Patterns: []string{"%{TEST_LOG_A}", "%{TEST_LOG_B}"},
Patterns: []string{"%{TEST_LOG_A}", "%{TEST_LOG_B}", "%{TEST_LOG_C}"},
CustomPatternFiles: []string{thisdir + "testdata/test-patterns"},
},
FromBeginning: true,
@@ -162,6 +162,40 @@ func TestGrokParseLogFilesOneBad(t *testing.T) {
})
}
func TestGrokParseLogFiles_TimestampInEpochMilli(t *testing.T) {
thisdir := getCurrentDir()
logparser := &LogParserPlugin{
Log: testutil.Logger{},
GrokConfig: GrokConfig{
MeasurementName: "logparser_grok",
Patterns: []string{"%{TEST_LOG_C}"},
CustomPatternFiles: []string{thisdir + "testdata/test-patterns"},
},
FromBeginning: true,
Files: []string{thisdir + "testdata/test_c.log"},
}
acc := testutil.Accumulator{}
acc.SetDebug(true)
assert.NoError(t, logparser.Start(&acc))
acc.Wait(1)
logparser.Stop()
acc.AssertContainsTaggedFields(t, "logparser_grok",
map[string]interface{}{
"clientip": "192.168.1.1",
"myfloat": float64(1.25),
"response_time": int64(5432),
"myint": int64(101),
},
map[string]string{
"response_code": "200",
"path": thisdir + "testdata/test_c.log",
})
}
func getCurrentDir() string {
_, filename, _, _ := runtime.Caller(1)
return strings.Replace(filename, "logparser_test.go", "", 1)

View File

@@ -12,3 +12,7 @@ TEST_LOG_B \[%{TEST_TIMESTAMP:timestamp:ts-"02/01/2006--15:04:05"}\] %{NUMBER:my
TEST_TIMESTAMP %{MONTHDAY}/%{MONTHNUM}/%{YEAR}--%{TIME}
TEST_LOG_BAD \[%{TEST_TIMESTAMP:timestamp:ts-"02/01/2006--15:04:05"}\] %{NUMBER:myfloat:float} %{WORD:mystring:int} %{WORD:dropme:drop} %{WORD:nomodifier}
# Test C log line:
# 1568723594631 1.25 200 192.168.1.1 5.432µs 101
TEST_LOG_C %{POSINT:timestamp:ts-epochmilli} %{NUMBER:myfloat:float} %{RESPONSE_CODE} %{IPORHOST:clientip} %{RESPONSE_TIME} %{NUMBER:myint:int}

View File

@@ -0,0 +1 @@
1568723594631 1.25 200 192.168.1.1 5.432µs 101