From 40fe22ea4ac90f2b7e047e76cb18ca0118b59556 Mon Sep 17 00:00:00 2001 From: Jordan Sissel Date: Fri, 18 Oct 2013 14:58:40 -0700 Subject: [PATCH 1/2] Try to fix any @timestamp values if someone mucks with that field value and turns it into a string through the json filter. --- lib/logstash/filters/json.rb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/logstash/filters/json.rb b/lib/logstash/filters/json.rb index 2bbaacfa6..09628bbc9 100644 --- a/lib/logstash/filters/json.rb +++ b/lib/logstash/filters/json.rb @@ -66,6 +66,14 @@ class LogStash::Filters::Json < LogStash::Filters::Base # which won't merge into a hash. If someone needs this, we can fix it # later. dest.merge!(JSON.parse(event[@source])) + + # This is a hack to help folks who are mucking with @timestamp during + # their json filter. You aren't supposed to do anything with "@timestamp" + # outside of the date filter, but nobody listens... ;) + if event["@timestamp"].is_a?(String) + event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime + end + filter_matched(event) rescue => e event.tag("_jsonparsefailure") From e36911a55cacbebe34ed7c8e9f78981f1d04d5c6 Mon Sep 17 00:00:00 2001 From: Jordan Sissel Date: Fri, 18 Oct 2013 17:15:50 -0700 Subject: [PATCH 2/2] - add test case --- spec/filters/json.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/spec/filters/json.rb b/spec/filters/json.rb index 080050237..340bfb79c 100644 --- a/spec/filters/json.rb +++ b/spec/filters/json.rb @@ -54,4 +54,19 @@ describe LogStash::Filters::Json do insist { subject["tags"] }.include?("_jsonparsefailure") end end + + describe "fixing @timestamp (#pull 733)" do + config <<-CONFIG + filter { + json { + source => "message" + } + } + CONFIG + + sample "{ \"@timestamp\": \"2013-10-19T00:14:32.996Z\" }" do + insist { subject["@timestamp"] }.is_a?(Time) + insist { subject["@timestamp"].to_json } == "\"2013-10-19T00:14:32.996Z\"" + end + end end