Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TimeParser gives wrong results for UNIX timestamps with micro- and nanoseconds #687

Closed
ppcad opened this issue Oct 11, 2024 · 2 comments · Fixed by #690
Closed

TimeParser gives wrong results for UNIX timestamps with micro- and nanoseconds #687

ppcad opened this issue Oct 11, 2024 · 2 comments · Fixed by #690
Assignees
Labels
bug Something isn't working

Comments

@ppcad
Copy link
Collaborator

ppcad commented Oct 11, 2024

The TimeParser gives wrong results for UNIX-timestamps with micro- and nanoseconds.
This happens because it assumes UNIX timestamps are given in microseconds if they are longer than 10 digits and divides by 1000.

Expected behavior
The TimeParser should parse UNIX timestamps corretly if their granularity is microseconds or nanoseconds.

Steps to reproduce
Use the Timestamper processor on events with UNIX timestamps with 16 (microsecond) or 19 (nanosecond) digits.

Environment

Logprep version: 13.4.0
Python version: 3.11

Possible solution
Divide UNIX timestamps by 10 ** (len(timestamp) - 10) instead of dividing it by 1000 or slice the timestamp to 13 digits if it's longer.

The problematic code is parsed_datetime = int(timestamp) if len(timestamp) <= 10 else int(timestamp) / 1000 in util/time.py.

@ppcad ppcad added the bug Something isn't working label Oct 11, 2024
@ppcad ppcad assigned ppcad and Malutthias and unassigned ppcad Oct 11, 2024
@Malutthias
Copy link
Collaborator

Malutthias commented Oct 29, 2024

Solution with dividing by the excess length worked after a few config changes, pr will be made soon.

@ppcad ppcad linked a pull request Oct 30, 2024 that will close this issue
@ppcad
Copy link
Collaborator Author

ppcad commented Oct 30, 2024

Closed by pull request #690.

@ppcad ppcad closed this as completed Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants