Details

    • Type: New Feature
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 1.2.3
    • Fix Version/s: 1.3.0-alpha5
    • Component/s: logback-core
    • Labels:
      None

      Description

      ILoggingEvent interface assumes that getTimeStamp() is in milliseconds.

       

      Elasticsearch @timestamp resolution is in milliseconds too, see https://github.com/elastic/elasticsearch/issues/10005

       

      As workaround people store second fraction in separate field in ES.

       

      When sorting by @timestamp in ES events are ordered randomly within millisecond. In contrast writing to file at any precision preserves ordering.

       

      Is it possible to increase timestamp resolution?

       

      With current hardware nanosecond resolution is pretty good.

       

      DETAILS:

       

      We collect log events into Elasticsearch with project that writes timestamp via:

      https://github.com/internetitem/logback-elasticsearch-appender/blob/master/src/main/java/com/internetitem/logback/elasticsearch/AbstractElasticsearchPublisher.java

       

         protected static String getTimestamp(long timestamp) {
             return DATE_FORMAT.get().format(new Date(timestamp));
         }

       

      https://github.com/internetitem/logback-elasticsearch-appender/blob/master/src/main/java/com/internetitem/logback/elasticsearch/ClassicElasticsearchPublisher.java

       

          public class ClassicElasticsearchPublisher extends AbstractElasticsearchPublisher<ILoggingEvent> {

              @Override
              protected void serializeCommonFields(JsonGenerator gen, ILoggingEvent event) throws IOException {
                  gen.writeObjectField("@timestamp", getTimestamp(event.getTimeStamp()));

       

      Only by changing ILoggingEvent or by providing alternative interface it would be possible to preserve timestamp in better resolution.

        Attachments

          Activity

            People

            • Assignee:
              ceki Ceki Gülcü
              Reporter:
              gavenkoa Oleksandr Gavenko
            • Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated: