Skip to content

String to timestamp conversion in transform #39226

@justrp

Description

@justrp

Component(s)

No response

What happened?

Description

I'm trying to fetch the timestamp from the log message as Time. I can capture it as String, but the conversion results in Empty()

Steps to Reproduce

  • Configure otel collector
  • publish log message 2025-04-08 00:53:20.438 INFO hello there

Expected Result

attributes.sdf contains time value (2025-04-08 00:53:20.438 +0000 UTC)

Actual Result

attributes.sdf contains Empty()

Collector version

0.123.0, 0.118.0

Environment information

Environment

docker.io/otel/opentelemetry-collector-contrib:0.123.0
and
docker.io/otel/opentelemetry-collector-contrib:0.118.0

OpenTelemetry Collector configuration

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: ${env:MY_POD_IP}:4317
      http:
        endpoint: ${env:MY_POD_IP}:4318
service:
  pipelines:
    logs:
      exporters:
      - debug
      processors:
      - transform
      receivers:
      - otlp
processors:
  batch: {}
  transform:
    error_mode: ignore
    log_statements:
    - context: log
      statements:
      - |
        merge_maps(attributes, ExtractGrokPatterns(body, "^%{TIMESTAMP_ISO8601:timestamp} %{WORD:log_level} %{GREEDYDATA:other}"), "upsert")
      - |
        set(attributes["sdf"], Time(attributes["timestamp"], "%Y-%m-%d %H:%M:%S.%L"))

Log output

ScopeLogs #0
ScopeLogs SchemaURL:
InstrumentationScope dial-core
LogRecord #0
ObservedTimestamp: 2025-04-08 00:57:37.334031824 +0000 UTC
Timestamp: 2025-04-08 00:57:37.334031824 +0000 UTC
SeverityText:
SeverityNumber: Unspecified(0)
Body: Str(2025-04-08 00:53:20.438 INFO <...>)
Attributes:
<...>
     -> timestamp: Str(2025-04-08 00:57:35.749)
<...>
     -> sdf: Empty()
<...>

Additional context

Tried on 0.118.0 and 0.123.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions