mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
93813a5079
It seems TS_MILLIS is specifically for Elasticsearch and starting with Elasticsearch 8.2 epoch_millis does (again?) support negative epoch_millis, so make Zeek produce that by default. If this breaks a given deployment, they can switch Zeek back to TS_MILLIS_UNSIGNED. https://discuss.elastic.co/t/migration-from-es-6-8-to-7-17-issues-with-negative-date-epoch-timestamp/335259 https://github.com/elastic/elasticsearch/pull/80208 Thanks for @timo-mue for reporting! Closes #4494
31 lines
1.1 KiB
Text
31 lines
1.1 KiB
Text
# @TEST-DOC: Test timestamp representations of a negative value in JSON.
|
|
#
|
|
# @TEST-EXEC: zeek -b %INPUT LogAscii::json_timestamps=JSON::TS_EPOCH;
|
|
# @TEST-EXEC: mv test.log test.log.ts_epoch
|
|
# @TEST-EXEC: zeek -b %INPUT LogAscii::json_timestamps=JSON::TS_MILLIS;
|
|
# @TEST-EXEC: mv test.log test.log.ts_millis
|
|
# @TEST-EXEC: zeek -b %INPUT LogAscii::json_timestamps=JSON::TS_MILLIS_UNSIGNED;
|
|
# @TEST-EXEC: mv test.log test.log.ts_millis_unsigned
|
|
# @TEST-EXEC: zeek -b %INPUT LogAscii::json_timestamps=JSON::TS_ISO8601
|
|
# @TEST-EXEC: mv test.log test.log.ts_iso8601
|
|
#
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff test.log.ts_epoch
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff test.log.ts_millis
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff test.log.ts_millis_unsigned
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff test.log.ts_iso8601
|
|
|
|
module TEST;
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
type Test: record {
|
|
ts: time &log;
|
|
};
|
|
}
|
|
|
|
redef LogAscii::use_json=T;
|
|
|
|
event zeek_init() {
|
|
Log::create_stream(TEST::LOG, [$columns=TEST::Test, $path="test"]);
|
|
Log::write(TEST::LOG, [$ts=double_to_time(-315619200)]);
|
|
}
|