Converting UTC timestamps in JSON logs to local time

[smokris]

I have this log line:

{"level":"INFO","loggerName":"logstash.agent","timeMillis":1662132959290,"thread":"Agent thread","logEvent":{"message":"Pipelines running","count":1,"running_pipelines":[{"metaClass":{"metaClass":{"metaClass":{"running_pipelines":"[:main]","non_running_pipelines":[]}}}}]}}

…and this log format definition:

Details

{
  "$schema": "https://lnav.org/schemas/format-v1.schema.json",
  "logstash": {
    "title": "Logstash JSON Log",
    "file-pattern": "logstash-json\\.log",
    "json": true,
    "hide-extra": true,
    "convert-to-local-time": true,
    "line-format": [
      { "field": "__timestamp__" }, " ",
      { "field": "loggerName", "min-width": 30 }, " ",
      { "field": "level", "min-width": 5, "max-width": 5 }, " ",
      { "field": "logEvent/message" }, " ",
      { "field": "logEvent/path" }
    ],
    "timestamp-field": "timeMillis",
    "timestamp-divisor": 1000,
    "level-field": "level",
    "body-field": "logEvent/message",
    "module-field": "loggerName",
    "value": {
      "timeMillis": { "kind": "integer" },
      "loggerName": { "kind": "string" },
      "level": { "kind": "string" },
      "logEvent/message": { "kind": "string" },
      "logEvent/path": { "kind": "string" }
    },
    "level": {
      "fatal": "FATAL",
      "error": "ERROR",
      "warning": "WARN",
      "info": "INFO",
      "debug": "DEBUG|TRACE"
    }
  }
}

The timestamp is 1662132959290 (15:35:59.290 in UTC, a.k.a. 11:35:59.290 in GMT-04:00). I'd like it to be displayed in my local timezone (GMT-04:00), but lnav displays it in UTC:

…
Sep  2 11:31:52 joku login[74828]: USER_PROCESS: 74828 ttys001
Sep  2 11:33:53 joku login[78944]: USER_PROCESS: 78944 ttys005
Sep  2 11:36:08 joku login[78944]: DEAD_PROCESS: 78944 ttys005
Sep  2 11:41:21 joku login[82505]: USER_PROCESS: 82505 ttys005
Sep  2 11:45:04 joku login[82505]: DEAD_PROCESS: 82505 ttys005
2022-09-02T15:35:59.290 logstash.agent  INFO  Pipelines running -  <--- this line is shown in UTC rather than local time

lnav shows all logs from this particular file at the bottom of the log view (rather than showing them interleaved with contemporary events from other log files), since it thinks they're in the future.

The log format definition specifies "convert-to-local-time": true, but whether it's true or false doesn't seem to have any effect.

I'm seeing the same result with both lnav 0.11.0 on macOS 12.5.1 and lnav 0.9.0 on CentOS Stream 8.

Is this a bug in lnav, or is there something I can change in my log format definition to make it convert the UTC timestamp to the local timezone?

[tstack]

Is this a bug in lnav

Yes, it's a bug. The local time conversion was only being done for textual time stamps. I've pushed a change that I think fixes the issue.

[smokris]

Thanks! The fix in #1038 works nicely.