to_float can't convert time to unixstamp.

[FengZh61]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

"log_timestamp":"2023-09-27T02:42:40.672720190Z"
.a,err = to_float(.log_timestamp) return 0.0

but .b = to_float(t'2023-09-27T02:42:40.672720190Z') return 1695782560.6727202

Configuration

[sources.file]
type = "file"
include = [ "/opt/file.log" ]
data_dir = "/opt/vector"
# Parse Syslog logs
# See the Vector Remap Language reference for more info: https://vrl.dev
[transforms.parse_logs]
type = "remap"
inputs = ["file"]
source = '''
. = parse_json!(string!(.message))
.a,err = to_float(.log_timestamp)
.b = to_float(t'2023-09-27T02:42:40.672720190Z')
'''

# Print parsed logs to stdout
[sinks.print]
type = "console"
inputs = ["parse_logs"]
encoding.codec = "json"

Version

vector 0.32.2 (x86_64-unknown-linux-musl beb74c1 2023-09-20 19:46:02.271601143)

Debug Output

No response

Example Data

{"log_timestamp":"2023-09-27T02:42:40.672720190Z","source":"localhost"}

Additional Context

No response

References

No response

Tasks

Preview Give feedback

No tasks being tracked yet.

[jszwedko]

Hi @FengZh61 !

This is expected behavior as to_float can only convert actual timestamps and not string timestamps. For your first example where you have a string timestamp you can use:

.a,err = to_float(parse_timestamp!(.log_timestamp, "%+"))

To parse the timestamp string first and then convert it to a float.

Hope this helps!

[FengZh61]

Hi @FengZh61 !

This is expected behavior as to_float can only convert actual timestamps and not string timestamps. For your first example where you have a string timestamp you can use:

.a,err = to_float(parse_timestamp!(.log_timestamp, "%+"))

To parse the timestamp string first and then convert it to a float.

Hope this helps!

It worked! Thank you~