Skip to content

Potential issue on @timestamp formats #40

@lucasponce

Description

@lucasponce

According to the template description:
https://github.com/ViaQ/elasticsearch-templates/blob/master/namespaces/_default_.yml#L17
The @timestamp field is parsed from a string with a possible pattern as
"yyyy-MM-dd'T'HH:mm:ss.SSSSSSZ"
Working in the integration plugins for Hawkular I realized about a potential problem on this.
For example:
"2017-04-03T18:05:35.415123+0200"
The field 415123 would be considered in Java as 415 seconds and 123 milliseconds with the pattern SSSSSSZ instead of 415 milliseconds and 123 nanoseconds as I think it should be parsed.
I am fixing this on Hawkular Alerting plugins but just leaving a note here as this potencial issue happens without hitting any exception (as the parsed is correct but with wrong calculation), but once I looked in detail I realized there was some unexpected drifts on the timestamps.

I haven't investigated if Elasticsearch is also affected by this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions