Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

opensearch timestamp problem #79

Open
ghost opened this issue Sep 2, 2022 · 0 comments
Open

opensearch timestamp problem #79

ghost opened this issue Sep 2, 2022 · 0 comments

Comments

@ghost
Copy link

ghost commented Sep 2, 2022

Problem

when i use th plugin, i found the fileds inclueds timestamp,and it's utc time,the timestamp should be the same as _source timestamp
image

...

Steps to replicate

<source>
 @type tail
 path /var/log/cron
 pos_file /var/log/os/os2.log.pos
 read_from_head true
 tag syslog.cron
 <parse>
    @type json
  </parse>
</source>

<match syslog.cron.**>
  @type opensearch
  scheme https
  ssl_verify false
  hosts xxxx  # hosts
  user admin
  password admin
  index_name oslog-cronjob-%Y%m%d
  <buffer tag,time>
   timekey 60
   timekey_wait 0
   timekey_use_utc false
   timekey_zone +0800
  </buffer>
</match>

Expected Behavior or What you need to ask

i think the timestamp will be use the

timekey_zone +0800

but it's not work.
...

Using Fluentd and OpenSearch plugin versions

  • OS version
    • Linux version 4.18.0-305.el8.x86_64
    • td-agent 4.3.2 fluentd 1.14.6
2022-09-02 10:39:29 +0800 [info]: starting fluentd-1.15.0 pid=52989 ruby="2.7.6"
2022-09-02 10:39:29 +0800 [info]: spawn command to main:  cmdline=["/opt/td-agent/bin/ruby", "-Eascii-8bit:ascii-8bit", "/opt/td-agent/bin/fluentd", "--log", "/var/log/td-agent/td-agent.log", "--daemon", "/var/run/td-agent/td-agent.pid", "--under-supervisor"]                                                                    
2022-09-02 10:39:30 +0800 [info]: adding match pattern="syslog.cron.**" type="opensearch"                                                                          
2022-09-02 10:39:30 +0800 [info]: adding source type="tail"
2022-09-02 10:39:30 +0800 [info]: #0 starting fluentd worker pid=53031 ppid=53028 worker=0                                                                         
2022-09-02 10:39:30 +0800 [info]: #0 following tail of /var/log/cron
2022-09-02 10:39:30 +0800 [info]: #0 fluentd worker is now running worker=0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

0 participants