vmware / fluent-plugin-vmware-loginsight

Fluentd plugin to forward logs to VMware Aria Operations for Logs
Other
10 stars 13 forks source link

No milliseconds send to log insight #32

Closed tom-mes closed 11 months ago

tom-mes commented 1 year ago

Describe the bug

The plugin is cutting the time to a maximum of seconds - no milliseconds are ingested:

Test call via docker:

docker run --log-driver=fluentd --log-opt fluentd-address=tcp://localhost:24224 --log-opt tag="myapp.comp" debian echo {\"foo\":\"bar\", \"timestamp\" : \"2023-08-22T10:48:02.121+02:00\"}

using this parser:

<parse>
  @type multi_format
  <pattern>
    format json
    time_key timestamp
    keep_time_key false
    time_format %Y-%m-%dT%H:%M:%S%z
  </pattern>
  <pattern>
    format json
    time_key timestamp
    keep_time_key false
    time_format %Y-%m-%dT%H:%M:%S.%N%z
  </pattern>      
</parse>

Internal view via debug output plugin:

2023-08-22 08:48:02.121000000 +0000 docker.driver.myapp.mycomp: {"log":"{\"foo\":\"bar\", \"timestamp\" : \"2023-08-22T10:48:02.121+02:00\"}","containerid":"708d819608497f3f274eab95bcb38df82db5a4874a46a8ba28face9988587654","containername":"/busy_stonebraker","log_source":"stdout","hostname":"146072cb652f","tag":"docker.driver.myapp.mycomp","fluentd_hostname":"","stage":"dev","application":"myapp","component":"mycomp","containershort":"708d81960849","foo":"bar","delivery":"fluentd"}

Debug of the json body send to loginsight:

"events":[{"fields":[{"name":"containerid","content":"708d819608497f3f274eab95bcb38df82db5a4874a46a8ba28face9988587654"},{"name":"containername","content":"/busy_stonebraker"},{"name":"log_source","content":"stdout"},{"name":"hostname","content":"146072cb652f"},{"name":"tag","content":"docker.driver.myapp.mycomp"},{"name":"fluentd_hostname","content":""},{"name":"stage","content":"dev"},{"name":"application","content":"myapp"},{"name":"component","content":"mycomp"},{"name":"containershort","content":"708d81960849"},{"name":"foo","content":"bar"},{"name":"delivery","content":"fluentd"}],"text":"{\"foo\":\"bar\", \"timestamp\" : \"2023-08-22T10:48:02.121+02:00\"}","timestamp":1692694082000}]}

As you see in the timestamp the milliseconds are not written.

Reproduction steps

See above

Expected behavior

Send milliseconds to loginsight

Additional context

No response