processorstrptime

README

日志时间提取（Strptime）

该插件可从指定字段中提取日志时间，时间格式为 Linux strptime。

参数说明

插件类型（type）为 processor_strptime。

参数	类型	必选或可选	参数说明
SourceKey	string	必选	源Key，为空不生效。
Format	string	必选	解析指定字段所使用的时间格式。
AdjustUTCOffset	bool	可选	是否对时间时区进行调整，默认为 false。
UTCOffset	int	可选	用于调整的时区偏移秒数，如 28800 表示东八区。
AlarmIfFail	bool	可选	提取失败时是否告警，默认为 true。
KeepSource	bool	可选	是否保留源字段，默认为true。

示例 1

以格式 %Y/%m/%d %H:%M:%S 解析字段 log_time 的值作为日志时间，时区使用机器时区，此处假设为东八区。

配置详情及处理结果如下：

• 输入

"log_time":"2016/01/02 12:59:59"

• 配置详情

{
  "processors":[
    {
      "type":"processor_strptime",
      "detail": {
        "SourceKey": "log_time",
        "Format": "%Y/%m/%d %H:%M:%S"
      }
    }
  ]
}

• 配置后结果

"log_time":"2016/01/02 12:59:59"
Log.Time = 1451710799

示例 2

时间格式同示例 1，但是配置中指定日志时区为东七区。

配置详情及处理结果如下：

• 输入

"log_time":"2016/01/02 12:59:59"

• 配置详情

{
  "processors":[
    {
      "type":"processor_strptime",
      "detail": {
        "SourceKey": "log_time",
        "Format": "%Y/%m/%d %H:%M:%S",
        "AdjustUTCOffset": true,
        "UTCOffset": 25200
      }
    }
  ]
}

• 配置后结果

"log_time":"2016/01/02 12:59:59"
Log.Time = 1451714399

Documentation

Index

• type Strptime
  • func (s *Strptime) Description() string
  • func (s *Strptime) Init(context ilogtail.Context) error
  • func (s *Strptime) ProcessLogs(logs []*protocol.Log) []*protocol.Log

Types

type Strptime

type Strptime struct {
	SourceKey              string `comment:"The source key prepared to be parsed by strptime."`
	Format                 string `comment:"The source key formatted pattern, more details please see [here](https://golang.org/pkg/time/#Time.Format)."`
	KeepSource             bool   `comment:"Optional. Specifies whether to keep the source key in the log content after the processing."`
	AdjustUTCOffset        bool   `comment:"Optional. Specifies whether to modify the time zone."`
	UTCOffset              int    `` /* 150-byte string literal not displayed */
	AlarmIfFail            bool   `comment:"Optional. Specifies whether to trigger an alert if the time information fails to be extracted."`
	EnablePreciseTimestamp bool   `comment:"Optional. Specifies whether to enable precise timestamp."`
	PreciseTimestampKey    string `comment:"Optional. The generated precise timestamp key."`
	PreciseTimestampUnit   string `comment:"Optional. The generated precise timestamp unit."`
	// contains filtered or unexported fields
}

Strptime use strptime to parse specified field (through SourceKey) with Format, and overwrite the time of log if parsing is successful.

Format comment Format follows rules of C strptime, but %Z does not support CST.

UTCOffset comment By default, the processor will use the local UTC offset if it can not find any information in Format (%z or %s). You can use this parameter to set customized offset, such as -28800 for UTC-8. Examples: 1. 2016/01/02 12:59:59 doesn't have offset information, assume as UTC0

• Default: set to local offset (UTC+8), get 2016/01/02 12:59:59 +0800.
• Set to UTC-8 (-28800): get 2016/01/02 12:59:59 -0800.

2. 2016/01/02 12:59:59 +0700 have offset information => 2016/01/02 05:59:59 +0000

• Default: if local offset is UTC+8, get 2016/01/02 13:59:59 +0800.
• Set to UTC-8 (-28800): get 2016/01/02 05:59:59 -0800.

func (*Strptime) Description

func (s *Strptime) Description() string

Description ...

func (*Strptime) Init

func (s *Strptime) Init(context ilogtail.Context) error

Init ...

func (*Strptime) ProcessLogs

func (s *Strptime) ProcessLogs(logs []*protocol.Log) []*protocol.Log

ProcessLogs ...