lib/fluent/plugin/out_google_cloud.rb
# Adjust timestamps from the future.
# The base case is:
# 0. The parsed timestamp is less than one day into the future.
# This is allowed by the API, and should be left unchanged.
#
# Beyond that, there are two cases:
# 1. The parsed timestamp is later in the current year:
# This can happen when system log lines from previous years are missing
# the year, so the date parser assumes the current year.
# We treat these lines as coming from last year. This could label
# 2-year-old logs incorrectly, but this probably isn't super important.
#
# 2. The parsed timestamp is past the end of the current year:
# Since the year is different from the current year, this isn't the
# missing year in system logs. It is unlikely that users explicitly
# write logs at a future date. This could result from an unsynchronized
# clock on a VM, or some random value being parsed as the timestamp.
# We reset the timestamp on those lines to the default value and let the
# downstream API handle it.
Adjust timestamps from the future.
The base case is:
0. The parsed timestamp is less than one day into the future.
This is allowed by the API, and should be left unchanged.

Beyond that, there are two cases:
1. The parsed timestamp is later in the current year:
This can happen when system log lines from previous years are missing
the year, so the date parser assumes the current year.
We treat these lines as coming from last year. This could label
2-year-old logs incorrectly, but this probably isn't super important.

2. The parsed timestamp is past the end of the current year:
Since the year is different from the current year, this isn't the
missing year in system logs. It is unlikely that users explicitly
write logs at a future date. This could result from an unsynchronized
clock on a VM, or some random value being parsed as the timestamp.
We reset the timestamp on those lines to the default value and let the
downstream API handle it.
Adjust timestamps from the future . The base case is : 0 . The parsed timestamp is less than one day into the future . This is allowed by the API and should be left unchanged . Beyond that there are two cases : 1 . The parsed timestamp is later in the current year : This can happen when system log lines from previous years are missing the year so the date parser assumes the current year . We treat these lines as coming from last year . This could label 2 - year - old logs incorrectly but this probably isn ' t super important . 2 . The parsed timestamp is past the end of the current year : Since the year is different from the current year this isn ' t the missing year in system logs . It is unlikely that users explicitly write logs at a future date . This could result from an unsynchronized clock on a VM or some random value being parsed as the timestamp . We reset the timestamp on those lines to the default value and let the downstream API handle it .
def adjust_timestamp_if_invalid(timestamp, current_time)
      ts_secs = timestamp.tv_sec
      ts_nanos = timestamp.tv_nsec
      next_year = Time.mktime(current_time.year + 1)
      one_day_later = current_time.to_datetime.next_day.to_time
      if timestamp < one_day_later 
      elsif timestamp >= next_year 
        ts_secs = 0
        ts_nanos = 0
      else 
        adjusted_timestamp = timestamp.to_datetime.prev_year.to_time
        ts_secs = adjusted_timestamp.tv_sec
      end
      [ts_secs, ts_nanos]
    end
def adjust_timestamp_if_invalid ( timestamp , current_time ) ts_secs = timestamp . tv_sec ts_nanos = timestamp . tv_nsec next_year = Time . mktime ( current_time . year + 1 ) one_day_later = current_time . to_datetime . next_day . to_time if timestamp < one_day_later elsif timestamp >= next_year ts_secs = 0 ts_nanos = 0 else adjusted_timestamp = timestamp . to_datetime . prev_year . to_time ts_secs = adjusted_timestamp . tv_sec end [ ts_secs , ts_nanos ] end
Adjust timestamps from the future.
Adjust timestamps from the future .
# Case 0. # Leave the timestamp as-is. # Case 2. # Case 1. # The value of ts_nanos should not change when subtracting a year.
timestamp
<not_specific>
current_time
<not_specific>