in_kubernetes_events: make timestamp from incoming record configurable

Signed-off-by: ryanohnemus <[email protected]>

Author: ryanohnemus

plugins/in_kubernetes_events/kubernetes_events.c

@@ -889,6 +889,11 @@ static struct flb_config_map config_map[] = {
       0, FLB_TRUE, offsetof(struct k8s_events, namespace),
       "kubernetes namespace to get events from, gets event from all namespaces by default."
     },
+    {
+       FLB_CONFIG_MAP_STR, "timestamp_key", K8S_EVENTS_RA_TIMESTAMP,
+       0, FLB_TRUE, offsetof(struct k8s_events, timestamp_key),
+       "Record accessor for the timestamp from the event. Default is $metadata['creationTimestamp']."
+    },
 
 #ifdef FLB_HAVE_SQLDB
     {

plugins/in_kubernetes_events/kubernetes_events.h

@@ -74,6 +74,9 @@ struct k8s_events {
 
     struct flb_log_event_encoder *encoder;
 
+    /* timestamp key */
+    flb_sds_t timestamp_key;
+
     /* record accessor */
     struct flb_record_accessor *ra_timestamp;
     struct flb_record_accessor *ra_resource_version;

plugins/in_kubernetes_events/kubernetes_events_conf.c

@@ -135,6 +135,7 @@ struct k8s_events *k8s_events_conf_create(struct flb_input_instance *ins)
     int ret;
     const char *p;
     const char *url;
+    const char *timestampKey;
     const char *tmp;
     struct k8s_events *ctx = NULL;
     pthread_mutexattr_t attr;
@@ -165,10 +166,14 @@ struct k8s_events *k8s_events_conf_create(struct flb_input_instance *ins)
     }
 
     /* Record accessor pattern */
-    ctx->ra_timestamp = flb_ra_create(K8S_EVENTS_RA_TIMESTAMP, FLB_TRUE);
+    timestampKey = flb_input_get_property("timestamp_key", ins);
+    if (!timestampKey ) {
+        timestampKey = K8S_EVENTS_RA_TIMESTAMP;
+    }
+    ctx->ra_timestamp = flb_ra_create(timestampKey, FLB_TRUE);
     if (!ctx->ra_timestamp) {
         flb_plg_error(ctx->ins,
-                      "could not create record accessor for metadata items");
+                      "could not create record accessor for record timestamp");
         k8s_events_conf_destroy(ctx);
         return NULL;
     }