From 2a8fb058e0a2d107695190558f3156ab92e41b08 Mon Sep 17 00:00:00 2001
From: akash1810 <akash1810@users.noreply.github.com>
Date: Fri, 13 Oct 2023 22:09:51 +0100
Subject: [PATCH] fix: Use custom parser to correctly process time field

This parser provides the correct time format.

Inspired by https://github.com/fluent/fluent-bit/blob/master/conf/parsers.conf
---
 ecs/Dockerfile   |  1 +
 ecs/custom.conf  | 16 ++++++++++------
 ecs/parsers.conf |  5 +++++
 3 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 ecs/parsers.conf

diff --git a/ecs/Dockerfile b/ecs/Dockerfile
index 7c99a45..ba2f106 100644
--- a/ecs/Dockerfile
+++ b/ecs/Dockerfile
@@ -1,2 +1,3 @@
 FROM amazon/aws-for-fluent-bit:latest
+ADD parsers.conf /parsers.conf
 ADD custom.conf /custom.conf
diff --git a/ecs/custom.conf b/ecs/custom.conf
index 9dca6c4..7542a49 100644
--- a/ecs/custom.conf
+++ b/ecs/custom.conf
@@ -1,14 +1,9 @@
 [SERVICE]
-    Parsers_File /fluent-bit/parsers/parsers.conf
+    Parsers_File /parsers.conf
 
 [FILTER]
     Name modify
     Match *
-    Add ShippedBy devx-logs-for-ecs
-    Add stack ${STACK}
-    Add stage ${STAGE}
-    Add app ${APP}
-    Add gu:repo ${GU_REPO}
     Rename log message
 
 [FILTER]
@@ -16,3 +11,12 @@
     Match *
     Key_Name message
     Parser json
+
+[FILTER]
+    Name modify
+    Match *
+    Add ShippedBy devx-logs
+    Add stack ${STACK}
+    Add stage ${STAGE}
+    Add app ${APP}
+    Add gu:repo ${GU_REPO}
diff --git a/ecs/parsers.conf b/ecs/parsers.conf
new file mode 100644
index 0000000..e089acc
--- /dev/null
+++ b/ecs/parsers.conf
@@ -0,0 +1,5 @@
+[PARSER]
+    Name json
+    Format json
+    Time_Key time
+    Time_Format %Y-%m-%dT%H:%M:%SZ