The documentation for es_index_from_timestamp says
Boolean flag, if true then any time interpolation (often used to generate the
ElasticSeach index) will use the timestamp from the processed message rather
than the system time.
But when looking at the code:
local ns
if cfg.es_index_from_timestamp then ns = tbl.Timestamp end
tbl.Timestamp = mi.get_timestamp_ms(ns)
it seems that also using system time vs. using time from log (message) depends on this flag. When ns is nil, mi.get_timestamp_ms(ns) will be computed based on current system time? Or am I missing something?
It might be better to call the parameter something like use_message_timestamp?
The documentation for
es_index_from_timestampsaysBut when looking at the code:
it seems that also using system time vs. using time from log (message) depends on this flag. When
nsisnil,mi.get_timestamp_ms(ns)will be computed based on current system time? Or am I missing something?It might be better to call the parameter something like
use_message_timestamp?