-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add processor to set timezone for an event #3902
Changes from 3 commits
a45355d
b2ad649
88cc4e7
7d2782e
7f84cb3
dd74400
eb4dea6
a06dd06
e6353be
6914c9a
ed01967
94dca42
f5f4b4c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
package actions | ||
|
||
import ( | ||
"time" | ||
|
||
"github.com/elastic/beats/libbeat/common" | ||
"github.com/elastic/beats/libbeat/processors" | ||
"github.com/pkg/errors" | ||
) | ||
|
||
type addLocale struct { | ||
timezone string | ||
} | ||
|
||
func init() { | ||
processors.RegisterPlugin("add_locale", newAddLocale) | ||
} | ||
|
||
func newAddLocale(c common.Config) (processors.Processor, error) { | ||
config := struct { | ||
TimeZone string `config:"timezone"` | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should this just be completely automatic using There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That's what i not understand correctly. I thought we give the user the option to set the timezone. If not so you are right. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think idea is to report the local timezone. It probably shouldn't be configurable at all. Just detect the local TZ and report it in the event. Once you have the timezone, you can use Logstash to do further transformations on the data (like interpreting syslog dates that are missing the timezone) or converting A more specific use case is analyzing logon events, the timezone can be used to determine if the event occurred during normal working hours. Then you can alert on people working after hours and send them on a vacation. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It looks like there's an even more direct way: There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hmm, am I misunderstanding the docs at https://golang.org/pkg/time/#Location ?
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. On golang Playground i get
??? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yep, you are right. I get the same thing "Local". So There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ok. Changed up to |
||
}{} | ||
|
||
err := c.Unpack(&config) | ||
if err != nil { | ||
return nil, errors.Wrap(err, "failed to unpack add_locale config") | ||
} | ||
|
||
l := addLocale{timezone: config.TimeZone} | ||
|
||
return l, nil | ||
} | ||
|
||
func (l addLocale) Run(event common.MapStr) (common.MapStr, error) { | ||
zone, err := time.LoadLocation(l.timezone) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The |
||
|
||
if err != nil { | ||
return event, err | ||
} | ||
|
||
event.Put("beat.timezone", zone.String()) | ||
return event, nil | ||
} | ||
|
||
func (l addLocale) String() string { | ||
return "add_locale=" + l.timezone | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,60 @@ | ||
package actions | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/elastic/beats/libbeat/common" | ||
"github.com/elastic/beats/libbeat/logp" | ||
"github.com/stretchr/testify/assert" | ||
) | ||
|
||
func TestExportTimeZone(t *testing.T) { | ||
var testConfig, _ = common.NewConfigFrom(map[string]interface{}{ | ||
"timezone": "America/Curacao", | ||
}) | ||
|
||
input := common.MapStr{} | ||
|
||
actual := getActualValue(t, testConfig, input) | ||
|
||
expected := common.MapStr{ | ||
"beat": map[string]string{ | ||
"timezone": "America/Curacao", | ||
}, | ||
} | ||
|
||
assert.Equal(t, expected.String(), actual.String()) | ||
} | ||
|
||
func TestExportDefaultTimeZone(t *testing.T) { | ||
var testConfig, _ = common.NewConfigFrom(map[string]interface{}{ | ||
"timezone": "", | ||
}) | ||
input := common.MapStr{} | ||
|
||
actual := getActualValue(t, testConfig, input) | ||
|
||
expected := common.MapStr{ | ||
"beat": map[string]string{ | ||
"timezone": "UTC", | ||
}, | ||
} | ||
|
||
assert.Equal(t, expected.String(), actual.String()) | ||
} | ||
|
||
func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr { | ||
if testing.Verbose() { | ||
logp.LogInit(logp.LOG_DEBUG, "", false, true, []string{"*"}) | ||
} | ||
|
||
p, err := newAddLocale(*config) | ||
if err != nil { | ||
logp.Err("Error initializing add_locale") | ||
t.Fatal(err) | ||
} | ||
|
||
actual, err := p.Run(input) | ||
|
||
return actual | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This whole config definition and the
Unpack
call can now be removed.