From e58d25e7706dc922fea9b6f6e5bbd33d2f055710 Mon Sep 17 00:00:00 2001 From: Greg Holt Date: Mon, 22 May 2017 09:45:08 -0700 Subject: [PATCH] Support for "ts" timestamps in JSON --- json_handler.go | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/json_handler.go b/json_handler.go index 0d6620e..396195d 100644 --- a/json_handler.go +++ b/json_handler.go @@ -42,7 +42,7 @@ func (h *JSONHandler) clear() { // TryHandle tells if this line was handled by this handler. func (h *JSONHandler) TryHandle(d []byte) bool { - if !bytes.Contains(d, []byte(`"time":`)) { + if !bytes.Contains(d, []byte(`"time":`)) && !bytes.Contains(d, []byte(`"ts":`)) { return false } err := h.UnmarshalJSON(d) @@ -62,13 +62,26 @@ func (h *JSONHandler) UnmarshalJSON(data []byte) error { } timeStr, ok := raw["time"].(string) + if ok { + delete(raw, "time") + } else { + timeStr, ok = raw["ts"].(string) + if ok { + delete(raw, "ts") + } + } if ok { h.Time, ok = tryParseTime(timeStr) if !ok { return fmt.Errorf("field time is not a known timestamp: %v", timeStr) } + } else if i, iOk := raw["ts"].(int64); iOk { + h.Time = time.Unix(i, 0) + delete(raw, "ts") + } else if f, fOk := raw["ts"].(float64); fOk { + h.Time = time.Unix(int64(f), int64((f-float64(int64(f)))*1000000000)) + delete(raw, "ts") } - delete(raw, "time") h.Message, _ = raw["msg"].(string) delete(raw, "msg")