opensearch-project / opensearch-project/data-prepper
Adding Timestamp Extraction to CloudWatch Logs Sink
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 374
- Forks
- 354
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
Currently the cloudwatch_logs sink publishes log events with the time at which the event is transmitted from the sink. There is no support for extracting an already existing timestamp from the event and using it as the timestamp of the event.
Describe the solution you'd like
A solution would be to extend the current plugin to include a timestamp extraction option. This would be configurable and would allow for the extraction of the timestamp.
Additional context
The timestamp could potentially be extracted in the following way:
- Through a user-entered date configuration. Where the sink would try to pull and use during transmission.
- Through the extraction of a Data-Prepper standard timestamp (via the Date Processor).
Both of these methods would also require the final date to be in UTC prior to being transmitted.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the cloudwatch_logs sink and reviewing how it currently assigns event timestamps. Then examine the Date Processor context mentioned in the issue and determine how a configurable timestamp source could be extracted and converted to UTC. Done means the sink supports the agreed extraction approach and transmits events with the extracted UTC timestamp.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- backend, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100