diff --git a/lib/logstash/filters/json.rb b/lib/logstash/filters/json.rb index 2bbaacfa6..09628bbc9 100644 --- a/lib/logstash/filters/json.rb +++ b/lib/logstash/filters/json.rb @@ -66,6 +66,14 @@ class LogStash::Filters::Json < LogStash::Filters::Base # which won't merge into a hash. If someone needs this, we can fix it # later. dest.merge!(JSON.parse(event[@source])) + + # This is a hack to help folks who are mucking with @timestamp during + # their json filter. You aren't supposed to do anything with "@timestamp" + # outside of the date filter, but nobody listens... ;) + if event["@timestamp"].is_a?(String) + event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime + end + filter_matched(event) rescue => e event.tag("_jsonparsefailure") diff --git a/spec/filters/json.rb b/spec/filters/json.rb index 080050237..340bfb79c 100644 --- a/spec/filters/json.rb +++ b/spec/filters/json.rb @@ -54,4 +54,19 @@ describe LogStash::Filters::Json do insist { subject["tags"] }.include?("_jsonparsefailure") end end + + describe "fixing @timestamp (#pull 733)" do + config <<-CONFIG + filter { + json { + source => "message" + } + } + CONFIG + + sample "{ \"@timestamp\": \"2013-10-19T00:14:32.996Z\" }" do + insist { subject["@timestamp"] }.is_a?(Time) + insist { subject["@timestamp"].to_json } == "\"2013-10-19T00:14:32.996Z\"" + end + end end