Terraform example leads to sporadic errors

[analytically]

Terraform example leads to sporadic errors

[tredman]

Hi - which terraform example are you using? Looks like cloudwatch-logs-json.tf?

This error is normal if a time field name has been specified but cannot be found in the event being processed. We use the time field name to assign the right timestamp to the event, otherwise the current time (time.Now()) is set.

The time field name is defined in the terraform config like this:

      TIME_FIELD_FORMAT = "%s(%L)?"
      TIME_FIELD_NAME = "start_time"

If your event has a timestamp field, you could use this to set that field name (and time format). Alternatively, setting "" for both values will use the current time when sending the event.

I should update the docs/comments to make this more clear. I'll leave this open and have a look at it during the week. Also happy to help if you have other questions.

[analytically]

Hi, yeah this is from vpc-flow-logs.tf. It seems that some VPC flow logs come with start timestamp while others don't.

[analytically]

I think the issue is TIME_FIELD_FORMAT. In your example it's set to "%s(%L)?" while VPC flow logs only include unix seconds.

[MikeGoldsmith]

We’re going to close this for now. Feel free to re-open, if it’s still relevant.