Override timestamp in log_to_metric or use native_json

[bmgante]

Hi all,
I am trying to use vector to generate metrics from logs (sent from nifi) using the log_to_metric. It works but i am not able to override the timestamp in the metric with a the .ts field comming from the log (need to send metrics in the past). Below my general vector config:

[sources.nifi]
type = "http"
address = "0.0.0.0:6000"
encoding = "json"

[transforms.remap]
type = "remap"
inputs = ["nifi"]
source = '''
del(.timestamp)
'''

[transforms.log_to_metric]
type = "log_to_metric"
inputs = ["remap"]

  [[transforms.log_to_metric.metrics]]
  type="gauge"
  name="{{name}}"
  field="value"

    [transforms.log_to_metric.metrics.tags]
    "label1" = "{{labels.label1}}"
    "label2" = "{{labels.label2}}"

[sinks.prometheus_remote]
type = "prometheus_remote_write"
inputs = ["log_to_metric"]
endpoint = "http://thanos-receiver.namespace.svc.cluster.local:10908/api/v1/receive"
healthcheck.enabled = false

Tried also to use in alternative the native_json approach but i am always getting error 500 parse error (even with the json well formatted).

[sources.nifi]
type = "http_server"
address = "0.0.0.0:6000"
decoding.codec = "native_json"

[sinks.prometheus_remote]
type = "prometheus_remote_write"
inputs = ["nifi"]
endpoint = "http://thanos-receiver.namespace.svc.cluster.local:10908/api/v1/receive"
healthcheck.enabled = false

Input json:

{
   "metric":{
      "name":"my_metric",
      "counter":{
         "value":17468
      },
      "kind":"incremental"
   }
}

Error from vector:
{"timestamp":"2025-04-30T12:04:23.324593Z","level":"ERROR","message":"unable to process request (internal error)","status":500,"error":"Some(Rejection(ErrorMessage { code: 400, message: \"Failed decoding body: ParsingError(Error parsing JSON: Error(\\\"EOF while parsing an object\\\", line: 1, column: 1))\" }))","target":"warp::filters::trace","span":{"component_id":"nifi","component_kind":"source","component_name":"nifi","component_type":"http_server","name":"source"},"spans":[{"component_id":"nifi","component_kind":"source","component_name":"nifi","component_type":"http_server","name":"source"}]}

Any idea out there?
Thanks

[pront]

Hi @bmgante, you are removing the timestamp with del(.timestamp) and you are not adding one later. Also, please take a look at the event model for metrics: https://vector.dev/docs/about/under-the-hood/architecture/data-model/metric/. It's stricter than logs.

[bmgante]

Hi @pront
Even without that remap got the same behaviour. I am wondering if log_to_metric does not allow timestamp override and considers always time of ingestion.

Wrt the json_native approach, any idea?