Preserve timezone for kubernetes_logs (containerd)

[nabokihms]

Hello, community ✋ I have a question about the container logs timezone.

Containerd keeps the time zone and adds it to container log timestamps. Example of timestamps in /var/log/pods directory:

2023-05-11T16:18:40.212624044+03:00 stderr F W0511 13:18:40.212327       1 warnings.go:70] flowcontrol.apiserver.k8s.io/v1beta1 FlowSchema is deprecated in v1.23+, unavailable in v1.26+; use flowcontrol.apiserver.k8s.io/v1beta2 FlowSchema

Timezone is present, but it is dropped on collecting

vector/src/sources/kubernetes_logs/parser/cri.rs

Line 101 in 74ae15e

Value::Timestamp(dt.with_timezone(&Utc)),

How can I keep the original timezone?

[spencergilbert]

I don't think it's possible today, seems like it'd need a code change. @jszwedko while not exactly the same cases I've noticed an uptick in questions/requests around TZs in our timestamps - we may want to take a review of how we're handling timestamps and TZs everywhere.

[nabokihms]

We would like to have this opportunity because some of our customers are tight to timezones.
I'd be more than happy if you could share some thoughts about how this feature can be implemented.

P.S. I think it is ok that vector reads all logs in UTC timezone. If only there would be a chance to change to local or any other timezone, e .g., via VRL, we could work around this limitation.

[nabokihms]

@spencergilbert @jszwedko

What do you think about adding the optional timezone argument to the format_timestamp VRL function?

$ ts = parse_timestamp!("10-Oct-2020 16:00+00:00", format: "%v %R %:z")
t'2020-10-10T16:00:00Z'
$ res = format_timestamp!(ts, format: "%+", tz: "Europe/Berlin")
"2020-10-10T18:00:00+02:00"

[jszwedko]

This seems like a sensible addition to me!

Separately I have suggested before that parsed timestamps include the timezone they were parsed with: #3333

[nabokihms]

vectordotdev/vrl#247