OpenStack log timestamps are stored into Elasticsearch without millisecs

[Rakesh Patnaik]

LMA collector drops the millisecond fraction of the log line (.876) as listed below

2016-12-01 07:35:34.867 21503 INFO nova.osapi_compute.wsgi.server [req-uuid usrid uuid - - -] xxx.xxx.xxx.xxx "GET /v2/uuid/os-services HTTP/1.1" status: 200 len: 2792 time: 0.0519361

it shows up on elastic search as follows missing the .867 value

       2016-12-01T07:35:34

I attempted modifying the elasticsearch encoder to state timestamp as follows but it stops sending to elasticsearch as some of the other logstreamers do not have the millisecond information as above.

/etc/log_collector/encoder-elasticsearch.toml
timestamp= "%Y-%m-%dT%H:%M:%S.%f"
and
timestamp= "%Y-%m-%dT%H:%M:%S.%L"

as documented at https://github.com/cactus/gostrftime/blob/master/gostrftime.go

[Simon Pasquier (simon-pasquier)]

This would require a new release of Heka because v0.10.0 doesn't support the %f flag.