Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Date processor to convert from epoch_milli or epoch_second #2929

Closed
graytaylor0 opened this issue Jun 23, 2023 · 1 comment · Fixed by #3860
Closed

Date processor to convert from epoch_milli or epoch_second #2929

graytaylor0 opened this issue Jun 23, 2023 · 1 comment · Fixed by #3860
Labels
enhancement New feature or request good first issue Good for newcomers Priority-High
Milestone

Comments

@graytaylor0
Copy link
Member

graytaylor0 commented Jun 23, 2023

Is your feature request related to a problem? Please describe.
As a user with Events that have keys with epoch milli timestamps, "{ "timestamp": 1687549774219 }, I would like to use the date processor to convert this timestamp to a date

Describe the solution you'd like
A new concept of built-in patterns for the date processor. So now, instead of just DateTimeFormatter patterns, the date processor will have a list of built in patterns such as epoch_milli, epoch_second, or epoch_nano. These patterns will work exactly the same as the regular date time patterns do. For example, the config will look like this

processor:
  - date:
        match:
           key: "timestamp"
           patterns: [ "epoch_milli", "epoch_second", "yyyy.MM.dd.hh.ss" ]

The date processor would first check if the timestamp is epoch milli, and if so it will convert it to a Date Time. If it wasn't found to be an epoch milli timestamp, then it will check for epoch_second, then finally the DateTime pattern.

Describe alternatives you've considered (Optional)
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

@marcottedan
Copy link

Supporting "epoch_nano" would be great as well if you're about to support these because it's something that can happen as well and I couldn't find good processor to convert a Nano to Milli (truncate the last 6 digits basically).

I was able to use Opensearch Dev Console to tell it to handle the Epoch Time in milliseconds (OS doesn't support Nanos) this way but it would be great to be able to do that in the Date Processor instead:

PUT /my-index
{
  "mappings": {
    "properties": {
      "eventtime": {
        "type": "date",
        "format": "epoch_millis"
      }
    }
  }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers Priority-High
Projects
Development

Successfully merging a pull request may close this issue.

4 participants