What's the Purpose of Time_Key in Fluent Bit Parsers?

To understand the Time_Key option, it helps to know that when you don't specify this option, Fluent Bit uses the current system time as the timestamp for each log entry.

When you use the Time_Key option in the parser configuration, you're specifying which field in your log data contains the actual timestamp. This is particularly useful when you want to preserve the original timestamp from the log source. Here's an example:

[PARSER]
    Name         json_parser
    Format       json
    Time_Key     timestamp

In this configuration, Fluent Bit will look for a field named "timestamp" in the JSON log data and use its value as the log entry's timestamp.

Additionally, you can use the Time_Keep option in conjunction with Time_Key:

[PARSER]
    Name         json_parser
    Format       json
    Time_Key     timestamp
    Time_Keep    On

The Time_Keep option, when set to "On", instructs Fluent Bit to retain the original timestamp field in the processed log entry. This can be useful if you need to reference the original timestamp later in your log processing pipeline.

Got an article suggestion? Let us know

Explore more

How to Check for Fluent Bit Internal Errors

Questions

How to Truncate Long Logs in Fluent Bit

Questions

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.