Open pikeas opened 3 hours ago
.ts = .timestamp ?? .ts
also fails.
If this is WAI, please update the docs to clarify that coalescing can only be used for error handling.
expression | The expression (operand) can be any fallible expression (eg, parse_json() but not parse_json!()) that returns an error.
This fails with:
From https://vector.dev/docs/reference/vrl/expressions/:
The error indicates that only errors may be coalesced, whereas the docs suggest that coalescing can be used generally, to select the first non-null value.
The intent here is to have a consistent timestamp field name after
parse_logfmt
is applied to heterogenous apps with different log outputs.