This is close, but there are a couple of things a bit off. First, what you've
written *only* works in a decoder. `write_message` isn't available in a filter,
to reinforce the fact that filters can't mutate messages, but only generate new
ones. Second, your code is a bit off, it could be as simple as:
function process_message ()
write_message("Fields[raw_timestamp]", read_message("Timestamp"))
return 0
end
It's much better to do this in a decoder than a filter, but if you have
multiple inputs you'd need to add the decoder to each one. But maybe your
Kibana tip will make this altogether unnecessary.
-r
On 03/07/2016 05:15 PM, Robbie Jacka wrote:
That's definitely doable, but it depends on whether you want to
implement it as a decoder or a filter. You could have a decoder or a
filter that does something like this (apologies in advance for the quick
and dirty Lua):
function process_message ()
msg = read_message("Payload")
if msg then
if msg.Timestamp then
write_message("Fields[raw_timestamp]", msg.Timestamp)
end
end
return 0
end
Also, a bit off-topic, but you *can* set the timezone to something other
than 'browser' in the dateFormat:tz settings, at least in Kibana 4+.
--
Robison Jacka / OpsEng / Weebly
On Mon, Mar 7, 2016 at 7:26 AM, Cristian Falcas <[email protected]
<mailto:[email protected]>> wrote:
Hello,
I have the vague impression that I sow this in a discussion, but I
can't find anything.
What I want to do is to add a new field to all messages. The content
should be copied from another field.
More precisely, it's about elasticsearch and the timestamp field.
Kibana, the "GUI" for elasticsearch, is "fixing" the timestamp field
by presenting it in the local timezone.
So I was thinking that if I copy the timestamp value to another
field, that field will be shown as is in the browser. How I would do
this in heka?
I'm not sure I'm making any sense, so please let me know if this is
the case and I will try to explain it better.
Thank you,
Cristian Falcas
_______________________________________________
Heka mailing list
[email protected] <mailto:[email protected]>
https://mail.mozilla.org/listinfo/heka
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
