From 90b886e555bf593a0b0e091f85252f2b8e1b69c4 Mon Sep 17 00:00:00 2001
From: Stanislaw Bogatkin <sbog@sbog.ru>
Date: Tue, 10 Jul 2018 18:41:42 +0300
Subject: [PATCH] Keep timestamp field

There are cases when we can lost original timestamp field given from
logs, like when we send our logs to the next fluentd forwarder in chain
of forwarders, it will rewrite our timestamp by default. Save
`Timestamp` field explicitly to avoid such situation and be able to
reconstruct messages date and time.

Closes-Bug: #1781046
Change-Id: I2b4486aedacbe16dc4c0fb2e4e4984bd80e59f2d
---
 ansible/roles/common/templates/conf/input/00-global.conf.j2 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ansible/roles/common/templates/conf/input/00-global.conf.j2 b/ansible/roles/common/templates/conf/input/00-global.conf.j2
index 448478bd5a..2817de4cb7 100644
--- a/ansible/roles/common/templates/conf/input/00-global.conf.j2
+++ b/ansible/roles/common/templates/conf/input/00-global.conf.j2
@@ -51,6 +51,7 @@
   format_firstline /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \d+ \S+ \S+ \[(req-\S+ \S+ \S+ \S+ \S+ \S+|-)\]/
   format1 /^(?<Timestamp>\S+ \S+) (?<Pid>\d+) (?<log_level>\S+) (?<python_module>\S+) (\[(req-(?<request_id>\S+) (?<user_id>\S+) (?<tenant_id>\S+) (?<domain_id>\S+) (?<user_domain>\S+) (?<project_domain>\S+)|-)\])? (?<Payload>.*)?$/
   time_key Timestamp
+  keep_time_key true
   time_format %F %T.%L
   ignore_repeated_permission_error true
   enable_watch_timer false