You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the solution you'd like
A mechanism to specify that the agent should use the timestamp in the log files (via timestamp_format or other means).
We are using structured JSON logs (as hopefully many are these days), so parsing out the timestamp could be done using a JSON parser instead of timestamp format regexes.
Even just a default where if the (JSON) structured log contained a property called "timestamp" or "time" that would be used as the logged timestamp. Using the parsing time is as the default timestamp is just really imprecise.
Describe alternatives you've considered
The alternative would be to generate an ISO8601 formatted timestamp in our log files and then parse it using the CloudWatch Agent - but this feels really suboptimal as the CloudWatch Agent is just converting it back into a timestamp after parsing. It would be preferable to be able to parse and use the epoch time directly from the log file entry.
The other option is to bypass the CloudWatch Agent altogether and post LogEvents directly to CloudWatch, but this feels like overkill.
Activity