How do you parse time that is formatted using golang's RFC3339Nano into @timestamp field?
It'll be easier to help if you post an example.
Here's one of the example
"2006-01-02T15:04:05.999999999Z07:00"
Is that a real example? I thought those timestamps can end with "Z" or a UTC offset, not both.
The @timestamp field doesn't have more than millisecond precision and I'm not sure the date filter is able to parse nanoseconds.
Iyap. I just copy paste that from the golang time package documentation.
Is there any way to remove the nano second part first and then parse it using date filter?
Is there any way to remove the nano second part first and then parse it using date filter?
Sure, you can e.g. use a mutate filter's gsub option.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.