-Modifying timestamp for tailed logs
Eric Bus 2012-07-31, 16:14
Is there a way to modify the timestamp property of an event? I have a webserver logfile that contains UNIX timestamps on each line. The log is being 'talied' by flume. I would like to use this timestamp as the event timestamp. I tried splitting the line before sending it to the sink, but that just adds a meta-data field timestamp and does not overwrite the timestamp field itself.
Is this possible? I'm using the Cloudera version of Flume (0.9.4)