(ranger) branch ranger-2.8 updated: RANGER-5404: fix incorrect evtTime format in audits to ElasticSearch (#746)

[madhan]

This is an automated email from the ASF dual-hosted git repository.

madhan pushed a commit to branch ranger-2.8
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/ranger-2.8 by this push:
     new bcc0de63d RANGER-5404: fix incorrect evtTime format in audits to 
ElasticSearch (#746)
bcc0de63d is described below

commit bcc0de63d8485a05b570cd0b8655b95a5e8fc1bd
Author: yunyezhang-work <yunyezhang_w...@163.com>
AuthorDate: Sun Nov 30 06:00:03 2025 +0800

    RANGER-5404: fix incorrect evtTime format in audits to ElasticSearch (#746)
    
    (cherry picked from commit 86d379f8706b8f6790175b97d7cea97ed56782f9)
---
 .../audit/destination/ElasticSearchAuditDestination.java | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git 
a/agents-audit/dest-es/src/main/java/org/apache/ranger/audit/destination/ElasticSearchAuditDestination.java
 
b/agents-audit/dest-es/src/main/java/org/apache/ranger/audit/destination/ElasticSearchAuditDestination.java
index c6c043dc1..e77aa5201 100644
--- 
a/agents-audit/dest-es/src/main/java/org/apache/ranger/audit/destination/ElasticSearchAuditDestination.java
+++ 
b/agents-audit/dest-es/src/main/java/org/apache/ranger/audit/destination/ElasticSearchAuditDestination.java
@@ -22,6 +22,8 @@
 import java.io.File;
 import java.io.IOException;
 import java.security.PrivilegedActionException;
+import java.text.DateFormat;
+import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -30,6 +32,7 @@
 import java.util.Locale;
 import java.util.Map;
 import java.util.Properties;
+import java.util.TimeZone;
 import java.util.concurrent.ThreadFactory;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
@@ -67,6 +70,12 @@
 public class ElasticSearchAuditDestination extends AuditDestination {
     private static final Logger LOG = 
LoggerFactory.getLogger(ElasticSearchAuditDestination.class);
 
+    private static final ThreadLocal<DateFormat> DATE_FORMAT = 
ThreadLocal.withInitial(() -> {
+        SimpleDateFormat format = new 
SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
+        format.setTimeZone(TimeZone.getTimeZone("UTC"));
+        return format;
+    });
+
     public static final String CONFIG_URLS = "urls";
     public static final String CONFIG_PORT = "port";
     public static final String CONFIG_USER = "user";
@@ -339,7 +348,12 @@ Map<String, Object> toDoc(AuthzAuditEvent auditEvent) {
         doc.put("resType", auditEvent.getResourceType());
         doc.put("reason", auditEvent.getResultReason());
         doc.put("action", auditEvent.getAction());
-        doc.put("evtTime", auditEvent.getEventTime());
+        Date eventTime = auditEvent.getEventTime();
+        if (eventTime != null) {
+            doc.put("evtTime", DATE_FORMAT.get().format(eventTime));
+        } else {
+            doc.put("evtTime", null);
+        }
         doc.put("seq_num", auditEvent.getSeqNum());
         doc.put("event_count", auditEvent.getEventCount());
         doc.put("event_dur_ms", auditEvent.getEventDurationMS());