Skip to main content

Troubleshooting

Quick Diagnosis​

# Check container status
docker ps | grep normalize

# Check recent logs
docker logs normalize-timestamps --tail 50 2>&1 | grep -i error

# Test timestamp normalization
curl -X POST http://localhost:8080/events \
  -H "Content-Type: application/json" \
  -d '{"event": "test", "timestamp": "2024-01-15T10:30:00-08:00"}'

Common Issues​

Timestamps not being parsed​

Cause: Format not recognized

# Check what formats are failing
docker logs normalize-timestamps --tail 20 2>&1 | grep timestamp

Fix: Add format to detection list:

Partial snippet
- mapping: |
    root = this
    root.timestamp = this.timestamp.ts_parse("2006-01-02T15:04:05Z07:00").catch(this.timestamp.ts_parse("01/02/2006 3:04 PM"))

Wrong timezone after conversion​

Cause: Input timezone not specified or detected

Fix: Explicitly set timezone for known sources:

Partial snippet
- mapping: |
    root = this
    let offset_timestamp = if this.timestamp.contains("T") { this.timestamp.ts_parse("2006-01-02T15:04:05Z07:00") } else if this.timestamp.length() > 19 { this.timestamp.ts_parse("2006-01-02 15:04:05 -07:00") } else { null }
    let local = if $offset_timestamp != null { $offset_timestamp } else { this.timestamp.ts_parse("2006-01-02 15:04:05") }
    let offset = $local.ts_format("-07:00", "America/Los_Angeles")
    let candidate = if $offset_timestamp != null { $offset_timestamp } else { (this.timestamp + " " + $offset).ts_parse("2006-01-02 15:04:05 -07:00") }
    let source_offset = $candidate.ts_format("-07:00", "America/Los_Angeles")
    let parsed = if $offset_timestamp != null { $offset_timestamp } else { (this.timestamp + " " + $source_offset).ts_parse("2006-01-02 15:04:05 -07:00") }
    root.timestamp = $parsed.ts_format("2006-01-02T15:04:05.999999999Z", "UTC")

Unix timestamps failing​

Cause: Milliseconds vs seconds confusion

Fix: Handle both:

Partial snippet
- mapping: |
    root = this
    root.timestamp_unix = if this.timestamp > 9999999999 { (this.timestamp / 1000).floor() } else { this.timestamp }

Future timestamps being accepted​

Cause: No validation on timestamp range

Fix: Add validation:

Partial snippet
- mapping: |
    if this.timestamp.ts_unix() > now().ts_unix() + 300 {
      throw("Timestamp too far in future")
    }

Still stuck?​

  1. Add debug logging: logger: {level: DEBUG}
  2. Check the Complete Pipeline for reference config
  3. Review Parse Logs for format detection patterns