diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 2ec48c26202..a5f2c37dfc9 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -69,6 +69,7 @@ - Handle case where policy doesn't contain Fleet connection information {pull}25707[25707] - Fix fleet-server.yml spec to not overwrite existing keys {pull}25741[25741] - Agent sends wrong log level to Endpoint {issue}25583[25583] +- Change timestamp in elatic-agent-json.log to use UTC {issue}25391[25391] ==== New features diff --git a/x-pack/elastic-agent/pkg/core/logger/logger.go b/x-pack/elastic-agent/pkg/core/logger/logger.go index e32c4b68088..77cc4260acc 100644 --- a/x-pack/elastic-agent/pkg/core/logger/logger.go +++ b/x-pack/elastic-agent/pkg/core/logger/logger.go @@ -8,6 +8,7 @@ import ( "fmt" "os" "path/filepath" + "time" "go.elastic.co/ecszap" "go.uber.org/zap/zapcore" @@ -23,6 +24,8 @@ import ( const agentName = "elastic-agent" +const iso8601Format = "2006-01-02T15:04:05.000Z0700" + // DefaultLogLevel used in agent and its processes. const DefaultLogLevel = logp.InfoLevel @@ -127,6 +130,20 @@ func makeInternalFileOutput(cfg *Config) (zapcore.Core, error) { return nil, errors.New("failed to create internal file rotator") } - encoder := zapcore.NewJSONEncoder(ecszap.ECSCompatibleEncoderConfig(logp.JSONEncoderConfig())) + encoderConfig := ecszap.ECSCompatibleEncoderConfig(logp.JSONEncoderConfig()) + encoderConfig.EncodeTime = utcTimestampEncode + encoder := zapcore.NewJSONEncoder(encoderConfig) return ecszap.WrapCore(zapcore.NewCore(encoder, rotator, cfg.Level.ZapLevel())), nil } + +// utcTimestampEncode is a zapcore.TimeEncoder that formats time.Time in ISO-8601 in UTC. +func utcTimestampEncode(t time.Time, enc zapcore.PrimitiveArrayEncoder) { + type appendTimeEncoder interface { + AppendTimeLayout(time.Time, string) + } + if enc, ok := enc.(appendTimeEncoder); ok { + enc.AppendTimeLayout(t.UTC(), iso8601Format) + return + } + enc.AppendString(t.UTC().Format(iso8601Format)) +}