How to extract timestamp correctly when engine is set as otel

[ndgohel]

We know how to extract timestamp when engine is fluentd. Timestamps are extracted incorrectly when engine is set as otel.

Here is an example event for which we need to know the configuration to extract timestamp:

{"Timestamp":"1681757004356","LogLevel":"INFO","SubSystem":"FW","TransactionID":"FW!70bae1a2-6dd6-4244-974a-437da4f92911","SoftwareVersion":"1.5.685_70418ac","HardwarePlatform":"SAV121","HardwareVersion":"SH1001er0.5","OSVersion":"Linux","ThreadName":"presence_msg_worker","CustomerID":"","SerialNumber":"AB5U277DD0035","EventType":"","CustomerSupportCaseID":"","RequestURL":"","RequestIP":"","Message":"bkend-rx[6][0] '{\"action\":\"get\",\"resource\":\"diagnostics/dumpDefprocs\",\"responseUrl\":\[http://127.0.0.1:4447/test\](http://127.0.0.1:4447/test/)}'","DeviceID":"DEV-2850-140-1024087072"}

[atoulme]

I guess you are using the logEngine otel in the helm chart. Is that correct? If so, please see the following to parse timestamps.

• Identify the extraOperators values.yaml configuration key: https://github.com/signalfx/splunk-otel-collector-chart/blob/main/helm-charts/splunk-otel-collector/values.yaml#L536
• https://github.com/open-telemetry/opentelemetry-log-collection/blob/main/docs/operators/json_parser.md
  Given your format, I would use:

- type: json_parser
  parse_from: body
  timestamp:
    parse_from: body.Timestamp
    layout_type: epoch
    layout: ms