how to use a parser to get epoch time from http json input

[jjgrinwis]

Hi all,

is it possible to set the TIMESTAMP field in an event received via HTTP input from the MESSAGE itself? The HTTP input plugin receives a simple JSON payload where one of the fields has epoch time in seconds (%s). I would like to set the TIMESTAMP of the event based on that specific field.

Tried using a parser like this:

[PARSER]
    Name        ds
    Format      json
    Time_Key    reqTimeSec
    Time_Format %s

But not sure how to use this parser with my filter as that one also wants a key_name so I'm bit confused how to use it.

[jjgrinwis]

lua script to the rescue:

function set_timestamp(tag, timestamp, record)
    local new_ts = record["reqTimeSec"]
    if new_ts then
        return 1, new_ts, record
    end
    return 1, timestamp, record
end

and the result:

[1] ds.log: [[1739818239.000000000, {}], {"reqId"=>"1239f220", "reqTimeSec"=>1739818239}]