From 6ce668e09dfb35495dfc2994d249f5831497d583 Mon Sep 17 00:00:00 2001 From: Holger Just Date: Tue, 5 Dec 2017 19:07:46 +0100 Subject: [PATCH] Allow to include the event's timestamp as a message tag in the Message encoder --- lib/rackstash/encoder/message.rb | 6 +++++- spec/rackstash/encoder/message_spec.rb | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/lib/rackstash/encoder/message.rb b/lib/rackstash/encoder/message.rb index fed45a4..a9ddebe 100644 --- a/lib/rackstash/encoder/message.rb +++ b/lib/rackstash/encoder/message.rb @@ -30,6 +30,7 @@ module Rackstash # # Logs "[foo,123] [127.0.0.1] Hello\n[foo,123] [127.0.0.1] World\n" class Message include Rackstash::Encoder::Helper::Message + include Rackstash::Encoder::Helper::Timestamp # @param tagged [Array<#to_s>] An array of field names whose values are # added in front of each message line on encode @@ -46,7 +47,10 @@ module Rackstash message = event[FIELD_MESSAGE] unless message.empty? - tags = @tagged_fields.map { |key| format_tag event[key] }.compact.join + tags = @tagged_fields.map { |key| + normalize_timestamp(event, key) + format_tag event[key] + }.compact.join message = message.gsub(/^/) { tags } unless tags.empty? end diff --git a/spec/rackstash/encoder/message_spec.rb b/spec/rackstash/encoder/message_spec.rb index d0e9f26..c2c3c31 100644 --- a/spec/rackstash/encoder/message_spec.rb +++ b/spec/rackstash/encoder/message_spec.rb @@ -39,6 +39,18 @@ describe Rackstash::Encoder::Message do expect(encoder.encode(event)).to eql "[foo,bar] line1\n[foo,bar] line2\n" end + it 'normalizes the timestamp' do + time = Time.parse('2016-10-17 13:37:00 +03:00') + event = { 'message' => ["line1\n", "line2\n"], '@timestamp' => time } + + tagged << '@timestamp' + + expect(encoder.encode(event)).to eql [ + "[2016-10-17T10:37:00.000000Z] line1\n", + "[2016-10-17T10:37:00.000000Z] line2\n" + ].join + end + it 'ignores missing fields' do event = { 'message' => ["line1\n", "line2\n"] } expect(encoder.encode(event)).to eql "line1\nline2\n"