Functionbeat unable to extract microsecond @timestamp using decode_json_fields

Elastic Stack Beats
1

I'm having issues extracting a @timestamp field from a nested JSON string (in standard ISO format),

It works if the nested timestamp has millisecond precision. It doesn't if it has microsecond or nanosecond precision.

This looks like it's the relevant code, but I don't know enough Go to work out if this (or some upstream JSON parsing) should be handling variable fractional seconds:

		if v, ok := data["@timestamp"]; ok {
			switch t := v.(type) {
			case time.Time:
				ts = t
			case common.Time:
				ts = time.Time(ts)
			}
			delete(data, "@timestamp")
		}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.