diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c7f1f817d65e..5763950a9cc6 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -94,6 +94,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff] - Update to Go 1.17.10 {issue}31636[31636] - Add support for nanosecond precision timestamps. {issue}15871[15871] {pull}31553[31553] +- Add new config option `timestamp.precision` to configure timestamps. {pull}31682[31682] *Auditbeat* diff --git a/auditbeat/auditbeat.reference.yml b/auditbeat/auditbeat.reference.yml index b03c95ab44cf..5d97c5c8a839 100644 --- a/auditbeat/auditbeat.reference.yml +++ b/auditbeat/auditbeat.reference.yml @@ -141,6 +141,10 @@ auditbeat.modules: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Auditbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml index a2a9538242b6..d7a1841ff68b 100644 --- a/filebeat/filebeat.reference.yml +++ b/filebeat/filebeat.reference.yml @@ -1260,6 +1260,10 @@ filebeat.inputs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Filebeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/filebeat/tests/system/config/filebeat_modules.yml.j2 b/filebeat/tests/system/config/filebeat_modules.yml.j2 index 93ded5a13799..cde1a3c750d4 100644 --- a/filebeat/tests/system/config/filebeat_modules.yml.j2 +++ b/filebeat/tests/system/config/filebeat_modules.yml.j2 @@ -38,3 +38,4 @@ setup.ilm: {% endif %} {% endif %} +timestamp.precision: nanosecond diff --git a/heartbeat/heartbeat.reference.yml b/heartbeat/heartbeat.reference.yml index 59380e2050fd..1f44a35db220 100644 --- a/heartbeat/heartbeat.reference.yml +++ b/heartbeat/heartbeat.reference.yml @@ -287,6 +287,10 @@ heartbeat.jobs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Heartbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/libbeat/_meta/config.yml.tmpl b/libbeat/_meta/config.yml.tmpl index 7d1f659a12c8..5422d8a1555e 100644 --- a/libbeat/_meta/config.yml.tmpl +++ b/libbeat/_meta/config.yml.tmpl @@ -14,6 +14,10 @@ #fields: # env: staging +# Configure the precision of all timestamps in {{ .BeatName | title }}. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + {{if not .ExcludeDashboards }} #============================== Dashboards ===================================== # These settings control loading the sample dashboards to the Kibana index. Loading diff --git a/libbeat/_meta/config/general.reference.yml.tmpl b/libbeat/_meta/config/general.reference.yml.tmpl index 27118c979c9e..b56988015b93 100644 --- a/libbeat/_meta/config/general.reference.yml.tmpl +++ b/libbeat/_meta/config/general.reference.yml.tmpl @@ -21,6 +21,10 @@ # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in {{ .BeatName | title }}. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/libbeat/cmd/instance/beat.go b/libbeat/cmd/instance/beat.go index c5f883481df9..06b0ae615509 100644 --- a/libbeat/cmd/instance/beat.go +++ b/libbeat/cmd/instance/beat.go @@ -131,6 +131,8 @@ type beatConfig struct { // Migration config to migration from 6 to 7 Migration *config.C `config:"migration.6_to_7"` + // TimestampPrecision sets the precision of all timestamps in the Beat. + TimestampPrecision *config.C `config:"timestamp"` } var debugf = logp.MakeDebug("beat") @@ -684,6 +686,10 @@ func (b *Beat) configure(settings Settings) error { b.Info.Name = name } + if err := common.SetTimestampPrecision(b.Config.TimestampPrecision); err != nil { + return fmt.Errorf("error setting timestamp precision: %w", err) + } + if err := configure.Logging(b.Info.Beat, b.Config.Logging); err != nil { return fmt.Errorf("error initializing logging: %w", err) } @@ -916,7 +922,7 @@ func (b *Beat) registerESIndexManagement() error { _, err := elasticsearch.RegisterConnectCallback(b.indexSetupCallback()) if err != nil { - return fmt.Errorf("failed to register index management with elasticsearch: %+v", err) + return fmt.Errorf("failed to register index management with elasticsearch: %w", err) } return nil } @@ -1184,11 +1190,11 @@ func initPaths(cfg *config.C) error { }{} if err := cfg.Unpack(&partialConfig); err != nil { - return fmt.Errorf("error extracting default paths: %+v", err) + return fmt.Errorf("error extracting default paths: %w", err) } if err := paths.InitPaths(&partialConfig.Path); err != nil { - return fmt.Errorf("error setting default paths: %+v", err) + return fmt.Errorf("error setting default paths: %w", err) } return nil } diff --git a/libbeat/common/datetime.go b/libbeat/common/datetime.go index 8ed6c81f9d83..4a96a74f891f 100644 --- a/libbeat/common/datetime.go +++ b/libbeat/common/datetime.go @@ -21,37 +21,121 @@ import ( "encoding/binary" "encoding/json" "errors" + "fmt" "hash" "time" "github.com/elastic/beats/v7/libbeat/common/dtfmt" + conf "github.com/elastic/elastic-agent-libs/config" ) const ( - // TsLayout is the seconds layout to be used in the timestamp marshaling/unmarshaling everywhere. - // The timezone must always be UTC. - TsLayout = "2006-01-02T15:04:05.000Z" + millisecPrecision TimestampPrecision = iota + 1 + microsecPrecision + nanosecPrecision + + DefaultTimestampPrecision = millisecPrecision tsLayoutMillis = "2006-01-02T15:04:05.000Z" tsLayoutMicros = "2006-01-02T15:04:05.000000Z" tsLayoutNanos = "2006-01-02T15:04:05.000000000Z" + + millisecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.fff'Z'" + microsecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.ffffff'Z'" + nanosecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.fffffffff'Z'" + + localMillisecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.fffz" + localMicrosecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.ffffffz" + localNanosecPrecisionFmt = "yyyy-MM-dd'T'HH:mm:ss.fffffffffz" +) + +// timestampFmt stores the format strings for both UTC and local +// form of a specific precision. +type timestampFmt struct { + utc string + local string +} + +var ( + defaultParseFormats = []string{ + tsLayoutMillis, + tsLayoutMicros, + tsLayoutNanos, + } + + precisions = map[TimestampPrecision]timestampFmt{ + millisecPrecision: timestampFmt{utc: millisecPrecisionFmt, local: localMillisecPrecisionFmt}, + microsecPrecision: timestampFmt{utc: microsecPrecisionFmt, local: localMicrosecPrecisionFmt}, + nanosecPrecision: timestampFmt{utc: nanosecPrecisionFmt, local: localNanosecPrecisionFmt}, + } + + // tsFmt is the selected timestamp format + tsFmt = precisions[DefaultTimestampPrecision] + // timeFormatter is a datettime formatter with a selected timestamp precision in UTC. + timeFormatter = dtfmt.MustNewFormatter(tsFmt.utc) ) // Time is an abstraction for the time.Time type type Time time.Time -var defaultTimeFormatter = dtfmt.MustNewFormatter("yyyy-MM-dd'T'HH:mm:ss.fffffffff'Z'") +type TimestampPrecision uint8 -var defaultParseFormats = []string{ - tsLayoutMillis, - tsLayoutMicros, - tsLayoutNanos, +type TimestampConfig struct { + Precision TimestampPrecision `config:"precision"` +} + +func defaultTimestampConfig() TimestampConfig { + return TimestampConfig{Precision: DefaultTimestampPrecision} +} + +func (p *TimestampPrecision) Unpack(v string) error { + switch v { + case "millisecond", "": + *p = millisecPrecision + case "microsecond": + *p = microsecPrecision + case "nanosecond": + *p = nanosecPrecision + default: + return fmt.Errorf("invalid timestamp precision %s, available options: millisecond, microsecond, nanosecond", v) + } + return nil +} + +// SetTimestampPrecision sets the precision of timestamps in the Beat. +// It is only supposed to be called during init because it changes +// the format of the timestamps globally. +func SetTimestampPrecision(c *conf.C) error { + if c == nil { + return nil + } + + p := defaultTimestampConfig() + err := c.Unpack(&p) + if err != nil { + return fmt.Errorf("failed to set timestamp precision: %w", err) + } + + tsFmt = precisions[p.Precision] + timeFormatter = dtfmt.MustNewFormatter(precisions[p.Precision].utc) + + return nil +} + +// TimestampFormat returns the datettime format string +// with the configured timestamp precision. It can return +// either the UTC format or the local one. +func TimestampFormat(local bool) string { + if local { + return tsFmt.local + } + return tsFmt.utc } // MarshalJSON implements json.Marshaler interface. // The time is a quoted string in the JsTsLayout format. func (t Time) MarshalJSON() ([]byte, error) { - str, _ := defaultTimeFormatter.Format(time.Time(t).UTC()) + str, _ := timeFormatter.Format(time.Time(t).UTC()) return json.Marshal(str) } @@ -87,7 +171,7 @@ func ParseTime(timespec string) (Time, error) { } func (t Time) String() string { - str, _ := defaultTimeFormatter.Format(time.Time(t).UTC()) + str, _ := timeFormatter.Format(time.Time(t).UTC()) return str } diff --git a/libbeat/common/datetime_test.go b/libbeat/common/datetime_test.go index 2065a0175f33..fb1fcef20be4 100644 --- a/libbeat/common/datetime_test.go +++ b/libbeat/common/datetime_test.go @@ -26,7 +26,9 @@ import ( "time" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + conf "github.com/elastic/elastic-agent-libs/config" "github.com/elastic/elastic-agent-libs/mapstr" ) @@ -49,6 +51,16 @@ func TestParseTime(t *testing.T) { Input: "2015-02-28T11:19:05.112Z", Output: time.Date(2015, time.February, 28, 11, 19, 05, 112*1e6, time.UTC), }, + // ParseTime must be able to parse microsecond precision timestamps + { + Input: "2015-02-28T11:19:05.000001Z", + Output: time.Date(2015, time.February, 28, 11, 19, 05, 1000, time.UTC), + }, + // ParseTime must be able to parse nanosecond precision timestamps + { + Input: "2015-02-28T11:19:05.000001122Z", + Output: time.Date(2015, time.February, 28, 11, 19, 05, 1122, time.UTC), + }, } for _, test := range tests { @@ -106,3 +118,44 @@ func TestTimeMarshal(t *testing.T) { assert.Equal(t, test.Output, string(result)) } } + +func TestTimeString(t *testing.T) { + tests := map[string]struct { + precisionCfg *conf.C + ts string + }{ + "empty config": { + nil, + "2015-03-01T11:19:05.000Z", + }, + "nanosecond precision": { + conf.MustNewConfigFrom(mapstr.M{ + "precision": "nanosecond", + }), + "2015-03-01T11:19:05.000001112Z", + }, + "millisecond precision": { + conf.MustNewConfigFrom(mapstr.M{ + "precision": "millisecond", + }), + "2015-03-01T11:19:05.000Z", + }, + "microsecond precision": { + conf.MustNewConfigFrom(mapstr.M{ + "precision": "microsecond", + }), + "2015-03-01T11:19:05.000001Z", + }, + } + + ts := Time(time.Date(2015, time.March, 01, 11, 19, 05, 1112, time.UTC)) + + for name, test := range tests { + t.Run(name, func(t *testing.T) { + err := SetTimestampPrecision(test.precisionCfg) + require.NoError(t, err, "precision must be set") + + require.Equal(t, test.ts, ts.String()) + }) + } +} diff --git a/libbeat/docs/generalconfig.asciidoc b/libbeat/docs/generalconfig.asciidoc index 859ead3705d2..a0bce6ea67e4 100644 --- a/libbeat/docs/generalconfig.asciidoc +++ b/libbeat/docs/generalconfig.asciidoc @@ -107,3 +107,9 @@ processors in your config. Sets the maximum number of CPUs that can be executing simultaneously. The default is the number of logical CPUs available in the system. + +[float] +==== `timestamp.precision` + +Configure the precision of all timestamps. By default it is set to microsecond. +Available options: millisecond, microsecond, nanosecond diff --git a/libbeat/outputs/codec/common.go b/libbeat/outputs/codec/common.go index 03d61b3a2927..16a8d47a6d7f 100644 --- a/libbeat/outputs/codec/common.go +++ b/libbeat/outputs/codec/common.go @@ -34,14 +34,7 @@ func MakeTimestampEncoder() func(*time.Time, structform.ExtVisitor) error { // MakeUTCOrLocalTimestampEncoder creates encoder function that formats time into RFC3339 representation // with UTC or local timezone in the output (based on localTime boolean parameter). func MakeUTCOrLocalTimestampEncoder(localTime bool) func(*time.Time, structform.ExtVisitor) error { - var dtPattern string - if localTime { - dtPattern = "yyyy-MM-dd'T'HH:mm:ss.fffffffffz" - } else { - dtPattern = "yyyy-MM-dd'T'HH:mm:ss.fffffffff'Z'" - } - - formatter, err := dtfmt.NewFormatter(dtPattern) + formatter, err := dtfmt.NewFormatter(common.TimestampFormat(localTime)) if err != nil { panic(err) } diff --git a/metricbeat/metricbeat.reference.yml b/metricbeat/metricbeat.reference.yml index 20c4e6d13038..8f3e3276b193 100644 --- a/metricbeat/metricbeat.reference.yml +++ b/metricbeat/metricbeat.reference.yml @@ -1014,6 +1014,10 @@ metricbeat.modules: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Metricbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/packetbeat/packetbeat.reference.yml b/packetbeat/packetbeat.reference.yml index 5f2f24c06d21..edb0df022b4e 100644 --- a/packetbeat/packetbeat.reference.yml +++ b/packetbeat/packetbeat.reference.yml @@ -636,6 +636,10 @@ packetbeat.ignore_outgoing: false # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Packetbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/packetbeat/tests/system/config/packetbeat.yml.j2 b/packetbeat/tests/system/config/packetbeat.yml.j2 index 0eca011cf33f..55823574e799 100644 --- a/packetbeat/tests/system/config/packetbeat.yml.j2 +++ b/packetbeat/tests/system/config/packetbeat.yml.j2 @@ -248,3 +248,7 @@ output.file: rotate_every_kb: {{ rotate_every_kb | default(1000) }} #number_of_files: 7 {%- endif %} + +{% if timestamp_precision %} +timestamp.precision: {{ timestamp_precision }} +{%- endif %} diff --git a/packetbeat/tests/system/test_0032_dns.py b/packetbeat/tests/system/test_0032_dns.py index 65c899de72f8..883ef8d118bc 100644 --- a/packetbeat/tests/system/test_0032_dns.py +++ b/packetbeat/tests/system/test_0032_dns.py @@ -13,6 +13,7 @@ def test_A(self): """ self.render_config_template( dns_ports=[53], + timestamp_precision="nanosecond", ) self.run_packetbeat(pcap="dns_google_com.pcap") diff --git a/packetbeat/tests/system/test_0050_icmp.py b/packetbeat/tests/system/test_0050_icmp.py index 09b86095ce34..614762f277e0 100644 --- a/packetbeat/tests/system/test_0050_icmp.py +++ b/packetbeat/tests/system/test_0050_icmp.py @@ -4,7 +4,9 @@ class Test(BaseTest): def test_2_pings(self): - self.render_config_template() + self.render_config_template( + timestamp_precision="nanosecond", + ) self.run_packetbeat(pcap="icmp/icmp_2_pings.pcap", debug_selectors=["*"]) objs = self.read_output() assert len(objs) == 2 @@ -24,13 +26,15 @@ def test_icmp4_ping(self): assert len(objs) == 1 assert objs[0]["icmp.version"] == 4 - assert objs[0]["@timestamp"] == "2015-10-19T20:49:23.817185Z" + assert objs[0]["@timestamp"] == "2015-10-19T20:49:23.817Z" assert objs[0]["event.duration"] == 20130000 self.assert_common_fields(objs) self.assert_common_icmp4_fields(objs[0]) def test_icmp4_ping_over_vlan(self): - self.render_config_template() + self.render_config_template( + timestamp_precision="nanosecond", + ) self.run_packetbeat(pcap="icmp/icmp4_ping_over_vlan.pcap", debug_selectors=["*"]) objs = self.read_output() @@ -48,13 +52,15 @@ def test_icmp6_ping(self): assert len(objs) == 1 assert objs[0]["icmp.version"] == 6 - assert objs[0]["@timestamp"] == "2015-10-19T20:49:23.872952Z" + assert objs[0]["@timestamp"] == "2015-10-19T20:49:23.872Z" assert objs[0]["event.duration"] == 16439000 self.assert_common_fields(objs) self.assert_common_icmp6_fields(objs[0]) def test_icmp6_ping_over_vlan(self): - self.render_config_template() + self.render_config_template( + timestamp_precision="nanosecond", + ) self.run_packetbeat(pcap="icmp/icmp6_ping_over_vlan.pcap", debug_selectors=["*"]) objs = self.read_output() diff --git a/packetbeat/tests/system/test_0062_cassandra.py b/packetbeat/tests/system/test_0062_cassandra.py index 9f9bdc0de39a..65199a3bf87e 100644 --- a/packetbeat/tests/system/test_0062_cassandra.py +++ b/packetbeat/tests/system/test_0062_cassandra.py @@ -26,7 +26,7 @@ def test_create_keyspace(self): assert o["event.dataset"] == "cassandra" assert o["event.duration"] == 62453000 assert o["event.start"] == o["@timestamp"] - assert o["event.end"] == "2016-06-28T09:03:53.502299Z" + assert o["event.end"] == "2016-06-28T09:03:53.502Z" assert o["client.ip"] == "127.0.0.1" assert o["client.port"] == 52749 assert o["client.bytes"] == 133 diff --git a/winlogbeat/winlogbeat.reference.yml b/winlogbeat/winlogbeat.reference.yml index ac54ff3510b1..f966e76da3bd 100644 --- a/winlogbeat/winlogbeat.reference.yml +++ b/winlogbeat/winlogbeat.reference.yml @@ -77,6 +77,10 @@ winlogbeat.event_logs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Winlogbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/auditbeat/auditbeat.reference.yml b/x-pack/auditbeat/auditbeat.reference.yml index 8fb193d3ecc9..55d845907d20 100644 --- a/x-pack/auditbeat/auditbeat.reference.yml +++ b/x-pack/auditbeat/auditbeat.reference.yml @@ -197,6 +197,10 @@ auditbeat.modules: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Auditbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index e4cae09afc49..2f050e7722b5 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -3589,6 +3589,10 @@ filebeat.inputs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Filebeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/filebeat/tests/system/config/filebeat_modules.yml.j2 b/x-pack/filebeat/tests/system/config/filebeat_modules.yml.j2 index 800dbb0d46d1..ddb3dcfbd68b 100644 --- a/x-pack/filebeat/tests/system/config/filebeat_modules.yml.j2 +++ b/x-pack/filebeat/tests/system/config/filebeat_modules.yml.j2 @@ -25,3 +25,5 @@ setup.kibana.host: {{ kibana_url }} {% if kibana_path %} setup.dashboards.directory: {{ kibana_path }} {% endif %} + +timestamp.precision: nanosecond diff --git a/x-pack/functionbeat/functionbeat.reference.yml b/x-pack/functionbeat/functionbeat.reference.yml index 5081df6499a2..188d42853087 100644 --- a/x-pack/functionbeat/functionbeat.reference.yml +++ b/x-pack/functionbeat/functionbeat.reference.yml @@ -319,6 +319,10 @@ functionbeat.provider.aws.functions: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Functionbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/heartbeat/heartbeat.reference.yml b/x-pack/heartbeat/heartbeat.reference.yml index 59380e2050fd..1f44a35db220 100644 --- a/x-pack/heartbeat/heartbeat.reference.yml +++ b/x-pack/heartbeat/heartbeat.reference.yml @@ -287,6 +287,10 @@ heartbeat.jobs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Heartbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index 9af0d0cbd9a9..31657e5fe823 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -1552,6 +1552,10 @@ metricbeat.modules: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Metricbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/osquerybeat/osquerybeat.reference.yml b/x-pack/osquerybeat/osquerybeat.reference.yml index 66dd59b39c6b..0a217c45d89e 100644 --- a/x-pack/osquerybeat/osquerybeat.reference.yml +++ b/x-pack/osquerybeat/osquerybeat.reference.yml @@ -38,6 +38,10 @@ seccomp.enabled: false # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Osquerybeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/packetbeat/packetbeat.reference.yml b/x-pack/packetbeat/packetbeat.reference.yml index 5f2f24c06d21..edb0df022b4e 100644 --- a/x-pack/packetbeat/packetbeat.reference.yml +++ b/x-pack/packetbeat/packetbeat.reference.yml @@ -636,6 +636,10 @@ packetbeat.ignore_outgoing: false # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Packetbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem') diff --git a/x-pack/winlogbeat/winlogbeat.reference.yml b/x-pack/winlogbeat/winlogbeat.reference.yml index 3866783fd203..bcfe437d214d 100644 --- a/x-pack/winlogbeat/winlogbeat.reference.yml +++ b/x-pack/winlogbeat/winlogbeat.reference.yml @@ -79,6 +79,10 @@ winlogbeat.event_logs: # sub-dictionary. Default is false. #fields_under_root: false +# Configure the precision of all timestamps in Winlogbeat. +# Available options: millisecond, microsecond, nanosecond +#timestamp.precision: millisecond + # Internal queue configuration for buffering events to be published. #queue: # Queue type by name (default 'mem')