Backport PR #16906 to 8.x: Add %{{TIME_NOW}} pattern for sprintf #16908
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport PR #16906 to 8.x branch, original message:
Release notes
Add support of
%{{TIME_NOW}}
syntax to sprinf format to generate a new current timestampWhat does this PR do?
This commit added
%{{TIME_NOW}}
syntax toevent.sprintf()
to generate a fresh timestamp as stringExample
It gives two different timestamps.
Why is it important/What is the impact to the user?
When the incoming event has value in
@timestamp
, eg. event from agent, Logstash use the provided value instead of generating a new timestamp. Prior to the change, there is no way to force a new timestamp to generate during the execution of input plugins.Previously, users often generate timestamp with ruby-filter
code => "event.set('ruby_time', Time.now());"
, but this approach requires events to pass through PQ before the timestamp was assigned. It is not a good indicator of when the event actually arrived in Logstash.With this change, all input and filter plugins can generate new timestamps
Checklist
Author's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs