[citrix_adc] Make date/time format configurable #11258
Conversation
* Customer was seeing errors when Citrix appliance sent DeLink logs with Day/Month/Year on days larger than 12 (so obviously not a month). * Found a lot of places where the default date formatting chooses month first, which will cause inaccuracies in how the data is stored. * Created a new integration option that will allow the customer to set the specific format (dd/MM/yyyy:HH:mm:ss is what this customer would use). * Needed to find all the places where date information is parsed and make sure they are consistent.
jrmolin
added
enhancement
packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
packages/citrix_adc/data_stream/log/agent/stream/stream.yml.hbs
Outdated
Show resolved
Hide resolved
andrewkroh
changed the title
| default: '' | ||
| description: |- | ||
| Format to use to parse the date/time fields in the data. | ||
| If not populated, this uses one of "yyyy/MM/dd:HH:mm:ss", "MM/dd/yyyy:HH:mm:ss", or the ISO8601 standard. |
There was a problem hiding this comment.
As a user, how do I learn what the available format specifiers are? I think we need to link to the relevant documentation or explicitly state what we are using to implement parsing so that the user can find the information.
There was a problem hiding this comment.
So link to the ingest pipeline on Date? So https://www.elastic.co/guide/en/elasticsearch/reference/current/date-processor.html?
There was a problem hiding this comment.
Oh, link to the formats allowed by the Java class I'm using. So https://docs.oracle.com/en/java/javase/22/docs/api/java.base/java/time/format/DateTimeFormatter.html ?
There was a problem hiding this comment.
The ES docs link out to DateTimeFormatter so I think that's what this should link users to as well.
There was a problem hiding this comment.
Ah, found them in the Painless documentation: https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-datetime.html. Looks exactly like what I'm trying to do. Should I fall back to the default parsing options?
🚀 Benchmarks reportTo see the full report comment with |
…b.com:jrmolin/integrations into citrix_adc/add_custom_date_time_format_option
andrewkroh
added
the
Team:Security-Deployment and Devices
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
|
💚 Build Succeeded
History
|
Proposed commit message
[citrix_adc] Make date/time format configurable
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots