logstash-plugins / logstash-input-gelf

Apache License 2.0
20 stars 39 forks source link

Gelf plugin use incorrect @timestamp #64

Closed os11k closed 4 years ago

os11k commented 4 years ago

Please post all product and debugging questions on our forum. Your questions will reach our wider community members there, and if we confirm that there is a bug, then we can open a new issue here.

For all general issues, please provide the following details for fast resolution:

I have Gelf plugin which gets uncompressed data from Freeswitch and then uploads it to kafka. Timestamp field what arrives to Kafka is not correct it is always 2 or 3 minutes before or after event. I would like to add that when I use docker for sending logs in same way and docker use compressed data, there is no such issue.

I'm usingx docker image of Logstash 7.4.2.

I have pretty simple config:

input {
    gelf {
        type => gelf
        port => 12201
    }
}

output {
        stdout {}
        kafka {
                bootstrap_servers => "aaaa.com:9092"
                security_protocol => "SASL_SSL"
                sasl_mechanism => "PLAIN"
                jaas_path => "/usr/share/logstash/config/jaas.conf"
                request_timeout_ms => "20000"
                topic_id =>  "logs"
                ssl_truststore_type => "PKCS12"
                ssl_truststore_location => "/usr/share/logstash/config/aaa.p12"
                ssl_truststore_password => "password"
                codec => "json"
        }
}

Strange part that if I check docker logs then I can't find that messages affected by timestamp, but I see all else, even so I have stdout {} what should duplicate everything to docker logs.

os11k commented 4 years ago

Issue seems in freeswitch, sorry for noise