Make timestamp conversation based on RFC3339

Allow timestamps without timezone. See elastic#1831 for more details

filebeat/input/event.go

@@ -69,14 +69,15 @@ func mergeJSONFields(f *FileEvent, event common.MapStr) {
 						event[jsonErrorKey] = "@timestamp not overwritten (not string)"
 						continue
 					}
-					// @timestamp must be of time common.Time
-					ts, err := common.ParseTime(vstr)
+
+					// @timestamp must be of format RFC3339
+					ts, err := time.Parse(time.RFC3339, vstr)
 					if err != nil {
 						logp.Err("JSON: Won't overwrite @timestamp because of parsing error: %v", err)
 						event[jsonErrorKey] = fmt.Sprintf("@timestamp not overwritten (parse error on %s)", vstr)
 						continue
 					}
-					event[k] = ts
+					event[k] = common.Time(ts)
 				} else if k == "type" {
 					vstr, ok := v.(string)
 					if !ok {

filebeat/tests/system/test_json.py

@@ -205,11 +205,12 @@ def test_timestamp_in_message(self):
         assert output[2]["json_error"] == \
             "@timestamp not overwritten (not string)"
 
-        assert output[3]["json_error"] is None, output[3]["json_error"]
-        assert output[3]["@timestamp"] == "2016-04-05T18:47:18.444+00:00", output[3]["@timestamp"]
+        assert "json_error" not in output[3]
+        assert output[3]["@timestamp"] == "2016-04-05T18:47:18.444Z", output[3]["@timestamp"]
+
+        assert "json_error" not in output[4]
+        assert output[4]["@timestamp"] == "2016-04-05T18:47:18.000Z", output[4]["@timestamp"]
 
-        assert output[4]["json_error"] is None, output[4]["json_error"]
-        assert output[4]["@timestamp"] == "2016-04-05T18:47:18+00:00", output[4]["@timestamp"]
     def test_type_in_message(self):
         """
         If overwrite_keys is true and type is in the message, we have to