parse_klog always parse the timestamp as UTC timezone

[Leo1003]

The logs outputs from kubelet are emitted with local timezone timestamp, however, the parse_klog() (and maybe also parse_glog()) function always parses them as UTC timestamp. This leads to hours of time shifting in the parsed log.

[jszwedko]

Hi @Leo1003 !

Could you give an example log message including the timestamp?

[Leo1003]

The following logs is generated from kubelet. The timestamp is based on the machine's timezone (Asia/Taipei UTC+8)

E1011 10:11:03.249539    5813 summary_sys_containers.go:83] "Failed to get system container stats" err="failed to get cgroup stats for \"/system.slice/kubelet.service\": failed to get container info for \"/system.slice/kubelet.service\": unknown container \"/system.slice/kubelet.service\"" containerName="/system.slice/kubelet.service"

According to the docs the timezone settings should default to the local timezone.

However, the parsed result is:

{ "file": "summary_sys_containers.go", "id": 5813, "level": "error", "line": 83, "message": "\"Failed to get system container stats\" err=\"failed to get cgroup stats for \\\"/system.slice/kubelet.service\\\": failed to get container info for \\\"/system.slice/kubelet.service\\\": unknown container \\\"/system.slice/kubelet.service\\\"\" containerName=\"/system.slice/kubelet.service\"", "timestamp": t'2023-10-11T10:11:03.249539Z' }

The parsed timestamp is 2023-10-11T10:11:03.249539Z, which is shifted 8 hours.

---

Note: klog uses time.Now()source and time.Clock()source.

[jszwedko]

Perfect, thanks for sharing that! As a workaround you could try using the timezone parameter on the remap transform where you are calling this VRL function. I'm not sure if that will definitely work, but something to try.