From 9cc5d24cafb1db4407115ca37c73da7151b7fdec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Stru=C3=9F?= Date: Fri, 26 Nov 2021 15:13:49 +0100 Subject: [PATCH] added capability to use elasticsearch datastreams --- pkg/kube/event.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkg/kube/event.go b/pkg/kube/event.go index 8e564e5a..e4d57f4f 100644 --- a/pkg/kube/event.go +++ b/pkg/kube/event.go @@ -2,14 +2,16 @@ package kube import ( "encoding/json" - corev1 "k8s.io/api/core/v1" "strings" "time" + + corev1 "k8s.io/api/core/v1" ) type EnhancedEvent struct { corev1.Event `json:",inline"` InvolvedObject EnhancedObjectReference `json:"involvedObject"` + Timestamp time.Time `json:"@timestamp"` } // DeDot replaces all dots in the labels and annotations with underscores. This is required for example in the @@ -45,6 +47,7 @@ type EnhancedObjectReference struct { // ToJSON does not return an error because we are %99 confident it is JSON serializable. // TODO(makin) Is it a bad practice? It's open to discussion. func (e *EnhancedEvent) ToJSON() []byte { + e.Timestamp = e.FirstTimestamp.Time b, _ := json.Marshal(e) return b }