search

logstash-plugins / logstash-filter-date

Apache License 2.0
7 stars 43 forks source link

Year 2038 problem #123

Open panaman opened 6 years ago

panaman commented 6 years ago

I ran across an issue if epoch 2414628000 is applied to the date filter, it will result in a _dateparsefailure

jakelandis commented 6 years ago

This is the 2038 problem. Any date past Jan 19, 2038 can't be represented as integer.

So if the epoch numeric value is greater then 2147483647 (int max) then the parse error will happen.

2414628000 is in 2046. If you use UNIX_MS and parse 2414628000 it will be Jan. 1970... but if you add the 2414628000000 it will parse correctly. This is because UNIX_MS expects there to MS as part of the epoch value AND it is back by long type.

This plugin should not be susceptible to the 2038 problem. In the mean time, if you know you data well enough, it is possible to work around this with the UNIX_MS (but it is an ugly hack).