Merge pull request #733 from logstash/support-@timestamp-in-json-filter-better

Try to fix any @timestamp values if someone mucks with that field value

lib/logstash/filters/json.rb

@@ -66,6 +66,14 @@ class LogStash::Filters::Json < LogStash::Filters::Base
       # which won't merge into a hash. If someone needs this, we can fix it
       # later.
       dest.merge!(JSON.parse(event[@source]))
+
+      # This is a hack to help folks who are mucking with @timestamp during
+      # their json filter. You aren't supposed to do anything with "@timestamp"
+      # outside of the date filter, but nobody listens... ;)
+      if event["@timestamp"].is_a?(String)
+        event["@timestamp"] = Time.parse(event["@timestamp"]).gmtime
+      end
+
       filter_matched(event)
     rescue => e
       event.tag("_jsonparsefailure")

spec/filters/json.rb

@@ -54,4 +54,19 @@ describe LogStash::Filters::Json do
       insist { subject["tags"] }.include?("_jsonparsefailure")
     end
   end
+
+  describe "fixing @timestamp (#pull 733)" do
+    config <<-CONFIG
+      filter {
+        json {
+          source => "message"
+        }
+      }
+    CONFIG
+
+    sample "{ \"@timestamp\": \"2013-10-19T00:14:32.996Z\" }" do
+      insist { subject["@timestamp"] }.is_a?(Time)
+      insist { subject["@timestamp"].to_json } == "\"2013-10-19T00:14:32.996Z\""
+    end
+  end
 end