That's definitely doable, but it depends on whether you want to implement
it as a decoder or a filter. You could have a decoder or a filter that does
something like this (apologies in advance for the quick and dirty Lua):
function process_message ()
msg = read_message("Payload")
if msg then
if msg.Timestamp then
write_message("Fields[raw_timestamp]", msg.Timestamp)
end
end
return 0
end
Also, a bit off-topic, but you *can* set the timezone to something other
than 'browser' in the dateFormat:tz settings, at least in Kibana 4+.
--
Robison Jacka / OpsEng / Weebly
On Mon, Mar 7, 2016 at 7:26 AM, Cristian Falcas <[email protected]>
wrote:
> Hello,
>
> I have the vague impression that I sow this in a discussion, but I can't
> find anything.
>
> What I want to do is to add a new field to all messages. The content
> should be copied from another field.
>
> More precisely, it's about elasticsearch and the timestamp field. Kibana,
> the "GUI" for elasticsearch, is "fixing" the timestamp field by presenting
> it in the local timezone.
>
> So I was thinking that if I copy the timestamp value to another field,
> that field will be shown as is in the browser. How I would do this in heka?
>
> I'm not sure I'm making any sense, so please let me know if this is the
> case and I will try to explain it better.
>
> Thank you,
> Cristian Falcas
>
>
> _______________________________________________
> Heka mailing list
> [email protected]
> https://mail.mozilla.org/listinfo/heka
>
>
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
