Description of problem:

LOG-7609 proposed to add a feature to extract the timestamp from logs at the point of ingestion. Investigation of the sink determined this to be problematic because it only evaluates the first N bytes of the message and it may not be consistent if they payload has more then one timestamp value (i.e. message is Viaq json). Additional inspection of ViaQ normalization found that timestamp is extracted from the log event for all sources with the exception of kube and openshift API audit logs.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:

3. ...

Actual results:

Expected results:

Additional info: