add observedTimestamp (#11)

Author: Jono Yan

enricher/ecs/ecs.go

@@ -94,9 +94,9 @@ func (enr *Enricher) EnrichRecord(r map[interface{}]interface{}, t time.Time) ma
 		}
 	}
 	return map[interface{}]interface{}{
-		"resource":          resource,
-		"body":              body,
-		"timestamp":         timestamp,
-		"observedTimestamp": t.UnixMilli(),
+		"resource":                  resource,
+		"body":                      body,
+		"timestamp":                 timestamp,
+		mappings.OBSERVED_TIMESTAMP: t.UnixMilli(),
 	}
 }

enricher/ecs/ecs_test.go

@@ -64,8 +64,8 @@ func TestEnrichRecords(t *testing.T) {
 					"other_key_2": "other_value_2",
 					"other_key_3": "other_value_3",
 				},
-				"timestamp":         "1234567890",
-				"observedTimestamp": int64(1257894425432),
+				"timestamp":                 "1234567890",
+				mappings.OBSERVED_TIMESTAMP: int64(1257894425432),
 			},
 		},
 	}

enricher/eks/eks.go

@@ -26,12 +26,14 @@ func NewEnricher() (*Enricher, error) {
 
 var _ enricher.IEnricher = (*Enricher)(nil)
 
-func (e Enricher) EnrichRecord(r map[interface{}]interface{}, _ time.Time) map[interface{}]interface{} {
+func (e Enricher) EnrichRecord(r map[interface{}]interface{}, t time.Time) map[interface{}]interface{} {
 	// add resource attributes
 	r["resource"] = map[interface{}]interface{}{
 		mappings.RESOURCE_CLOUD_ACCOUNT_ID: e.AccountId,
 		mappings.RESOURCE_ACCOUNT_GROUP:    e.CanvaAccountFunction,
 	}
 
+	r[mappings.OBSERVED_TIMESTAMP] = t.UnixMilli()
+
 	return r
 }

enricher/eks/eks_test.go

@@ -18,11 +18,11 @@ func TestValidNewEnricher(t *testing.T) {
 			Name: "Gets AccountId",
 			Env: map[string]string{
 				mappings.ENV_ACCOUNT_ID:    "1234567890",
-				mappings.ENV_ACCOUNT_GROUP: DummyAccountGroup,
+				mappings.ENV_ACCOUNT_GROUP: DummyAccountFunction,
 			},
 			Expected: &Enricher{
 				AccountId:            "1234567890",
-				CanvaAccountFunction: DummyAccountGroup,
+				CanvaAccountFunction: DummyAccountFunction,
 			},
 		},
 		{
@@ -61,7 +61,7 @@ func TestInvalidNewEnricher(t *testing.T) {
 	assert.Error(t, err)
 }
 
-func TestEnrichRecordsWithAccountId(t *testing.T) {
+func TestEnrichRecords(t *testing.T) {
 	var cases = []struct {
 		Name     string
 		Enricher Enricher
@@ -72,21 +72,22 @@ func TestEnrichRecordsWithAccountId(t *testing.T) {
 			Name: "Adds Account Id",
 			Enricher: Enricher{
 				AccountId:            "1234567",
-				CanvaAccountFunction: DummyAccountGroup,
+				CanvaAccountFunction: DummyAccountFunction,
 			},
 			Input: map[interface{}]interface{}{
 				"log": "hello world",
 			},
 			Expected: map[interface{}]interface{}{
-				"log": "hello world",
+				mappings.OBSERVED_TIMESTAMP: ExpectedTime,
+				"log":                       "hello world",
 				"resource": map[interface{}]interface{}{
 					mappings.RESOURCE_CLOUD_ACCOUNT_ID: "1234567",
-					mappings.RESOURCE_ACCOUNT_GROUP:    DummyAccountGroup,
+					mappings.RESOURCE_ACCOUNT_GROUP:    DummyAccountFunction,
 				},
 			},
 		},
 		{
-			Name: "Adds Account Group",
+			Name: "Adds Account Group Function",
 			Enricher: Enricher{
 				AccountId:            DummyAccountId,
 				CanvaAccountFunction: "PII",
@@ -95,7 +96,8 @@ func TestEnrichRecordsWithAccountId(t *testing.T) {
 				"log": "hello world",
 			},
 			Expected: map[interface{}]interface{}{
-				"log": "hello world",
+				mappings.OBSERVED_TIMESTAMP: ExpectedTime,
+				"log":                       "hello world",
 				"resource": map[interface{}]interface{}{
 					mappings.RESOURCE_CLOUD_ACCOUNT_ID: DummyAccountId,
 					mappings.RESOURCE_ACCOUNT_GROUP:    "PII",
@@ -113,7 +115,11 @@ func TestEnrichRecordsWithAccountId(t *testing.T) {
 }
 
 var (
-	DummyTime         = time.Now()
-	DummyAccountGroup = "general"
-	DummyAccountId    = "Account_Id"
+	DummyAccountFunction = "general"
+	DummyAccountId       = "Account_Id"
+	DummyTime            = time.Date(2009, time.November, 10, 23, 7, 5, 432000000, time.UTC)
+)
+
+var (
+	ExpectedTime = int64(1257894425432)
 )

enricher/mappings/mappings.go

@@ -1,5 +1,9 @@
 package mappings
 
+const (
+	OBSERVED_TIMESTAMP = "observedTimestamp"
+)
+
 const (
 	RESOURCE_CLOUD_ACCOUNT_ID = "cloud.account.id"
 	RESOURCE_ACCOUNT_GROUP    = "canva.account.function"