From 95d511dabeb7d7b135e7afc29314fa5ab5785b89 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=B5=9C=ED=98=84=EA=B1=B8?= Date: Fri, 8 Aug 2025 11:23:28 +0900 Subject: [PATCH] Fix JSON filter @timestamp parsing to match JSON codec behavior - Add special handling for @timestamp field in Event.setField() method - Ensure @timestamp is properly converted to Timestamp object when set via setField - Maintain consistency between JSON codec and JSON filter behavior - Add failure tagging for invalid timestamp formats - Fixes issue where JSON filter would not parse @timestamp as Timestamp object --- logstash-core/src/main/java/org/logstash/Event.java | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/logstash-core/src/main/java/org/logstash/Event.java b/logstash-core/src/main/java/org/logstash/Event.java index e1e9f4db1f2..b593f04f983 100644 --- a/logstash-core/src/main/java/org/logstash/Event.java +++ b/logstash-core/src/main/java/org/logstash/Event.java @@ -216,6 +216,17 @@ public void setField(final FieldReference field, final Object value) { throw new InvalidTagsTypeException(field, value); } + // Special handling for @timestamp field to ensure it's properly converted to Timestamp object + if (field.equals(FieldReference.TIMESTAMP_REFERENCE)) { + Timestamp parsedTimestamp = initTimestamp(value); + setTimestamp(parsedTimestamp == null ? Timestamp.now() : parsedTimestamp); + if (parsedTimestamp == null) { + tag(TIMESTAMP_FAILURE_TAG); + this.setField(TIMESTAMP_FAILURE_FIELD, value); + } + return; + } + switch (field.type()) { case FieldReference.META_PARENT: // ConvertedMap.newFromMap already does valuefication