opensearch-project / opensearch-project/data-prepper

Adding Timestamp Extraction to CloudWatch Logs Sink

Open
#3,106 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement plugin - sink
Dominant language
Java
Stars
374
Forks
354
Avg merge
3d 18h
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
Currently the cloudwatch_logs sink publishes log events with the time at which the event is transmitted from the sink. There is no support for extracting an already existing timestamp from the event and using it as the timestamp of the event.

Describe the solution you'd like
A solution would be to extend the current plugin to include a timestamp extraction option. This would be configurable and would allow for the extraction of the timestamp.

Additional context
The timestamp could potentially be extracted in the following way:

  • Through a user-entered date configuration. Where the sink would try to pull and use during transmission.
  • Through the extraction of a Data-Prepper standard timestamp (via the Date Processor).

Both of these methods would also require the final date to be in UTC prior to being transmitted.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the cloudwatch_logs sink and reviewing how it currently assigns event timestamps. Then examine the Date Processor context mentioned in the issue and determine how a configurable timestamp source could be extracted and converted to UTC. Done means the sink supports the agreed extraction approach and transmits events with the extracted UTC timestamp.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
backend, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.