Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Timestamp formatting options #17

Open
jalvz opened this issue May 26, 2021 · 3 comments
Open

Timestamp formatting options #17

jalvz opened this issue May 26, 2021 · 3 comments
Labels
enhancement New feature or request

Comments

@jalvz
Copy link

jalvz commented May 26, 2021

Add flags for an alternative (aka shorter) timestamp format, and to convert to local time zone.

@trentm
Copy link
Owner

trentm commented Jun 4, 2021

For the record, some earlier work and discussion at #14

@trentm
Copy link
Owner

trentm commented Jun 4, 2021

Some possible time formats:

  • 2021-05-20T22:50:49.878Z default format is "rfc3339"
  • 22:50:49 or 22:50:49.878 - "time", just the time (with different precision)
  • 2021-05-20 15:50:49.878 - "local", "local datetime", at least for me (though to be RFC compliant it should include the time offset, but that's long). Could drop the "T" to indicate that we are off spec.
  • 15:50:49.878 - "local time"
  • 21-05-10 13:40:04 - jalvz short form from Space time #14, not sure about a name for this one.
  • I'm hesitant to support the Go time format because it so weird and awkward.
  • 49.878 - "seconds" or "s" for short
  • 50:49.878 - "minutes" or "m" for short
  • 15:50:49.878 - "hours" or "h" for short
  • 0, 1h2m0.3s - "offset" (or some other name) to show the duration since the
    first record, using 0 for the first record. Using go's func (Duration) String.
  • Perhaps another one to show the duration since the last record, rather than
    the first. What name for this one?

Proposal: Implement a -t, --time format (timeFormat config var) option for the format to use for the @timestamp, implementing some or all of the names in the list above.

Q: What about whether to display brackets around the time?

Some title lines from demo.log, apm-server, elasticsearch, and kibana:

[2021-02-11T06:24:53.251Z]  WARN (on purple.local): error fields
[2021-05-20T22:53:45.304Z]  INFO (request): request accepted
[2021-05-20T22:50:49.878Z]  INFO (org.elasticsearch.cluster.metadata.MetadataCreateIndexService/ES_ECS): [.kibana-event-log-8.0.0-snapshot-000001] creating index, cause [api], templates [.kibana-event-log-8.0.0-template, .kibana-event-log-8.0.0-snapshot-template], shards [1]/[1]
[2021-05-20T22:50:50+00:00] : Installed all assets

For starters, time format conversion should assume the raw @timestamp
is in RFC3339 format.

@trentm
Copy link
Owner

trentm commented Sep 30, 2021

Actually the default format should be "raw" or something, i.e. use the string exactly as it is in the log record.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants