This is close, but there are a couple of things a bit off. First, what you've written *only* works in a decoder. `write_message` isn't available in a filter, to reinforce the fact that filters can't mutate messages, but only generate new ones. Second, your code is a bit off, it could be as simple as:
function process_message () write_message("Fields[raw_timestamp]", read_message("Timestamp")) return 0 end It's much better to do this in a decoder than a filter, but if you have multiple inputs you'd need to add the decoder to each one. But maybe your Kibana tip will make this altogether unnecessary. -r On 03/07/2016 05:15 PM, Robbie Jacka wrote:
That's definitely doable, but it depends on whether you want to implement it as a decoder or a filter. You could have a decoder or a filter that does something like this (apologies in advance for the quick and dirty Lua): function process_message () msg = read_message("Payload") if msg then if msg.Timestamp then write_message("Fields[raw_timestamp]", msg.Timestamp) end end return 0 end Also, a bit off-topic, but you *can* set the timezone to something other than 'browser' in the dateFormat:tz settings, at least in Kibana 4+. -- Robison Jacka / OpsEng / Weebly On Mon, Mar 7, 2016 at 7:26 AM, Cristian Falcas <cristi.fal...@gmail.com <mailto:cristi.fal...@gmail.com>> wrote: Hello, I have the vague impression that I sow this in a discussion, but I can't find anything. What I want to do is to add a new field to all messages. The content should be copied from another field. More precisely, it's about elasticsearch and the timestamp field. Kibana, the "GUI" for elasticsearch, is "fixing" the timestamp field by presenting it in the local timezone. So I was thinking that if I copy the timestamp value to another field, that field will be shown as is in the browser. How I would do this in heka? I'm not sure I'm making any sense, so please let me know if this is the case and I will try to explain it better. Thank you, Cristian Falcas _______________________________________________ Heka mailing list Heka@mozilla.org <mailto:Heka@mozilla.org> https://mail.mozilla.org/listinfo/heka _______________________________________________ Heka mailing list Heka@mozilla.org https://mail.mozilla.org/listinfo/heka
_______________________________________________ Heka mailing list Heka@mozilla.org https://mail.mozilla.org/listinfo/heka