Why is time key not dropped?

[gajus]

The parser:

[PARSER]
    name argo
    format logfmt
    time_key time
    time_format %Y-%m-%dT%H:%M:%S %z
    time_keep false

Example ingested log:

time="2022-12-09T19:55:41Z" level=info msg="Reconciliation completed" application=argocd/contra-application-sets dest-name= dest-namespace=argocd dest-server="https://kubernetes.default.svc" fields.level=0 time_ms=4

Example processed log:

{
  "insertId": "1fcef95eqrbik",
  "jsonPayload": {
    "kubernetes": {
      "container_hash": "quay.io/argoproj/argocd@sha256:8283a9f06033c2377dc61b03daf4994a3ab961c53d79ed32b9aebadf79bb4858",
      "labels": {
        "app.kubernetes.io/component": "application-controller",
        "app.kubernetes.io/part-of": "argocd",
        "statefulset.kubernetes.io/pod-name": "contra-argo-cd-argocd-application-controller-0",
        "app.kubernetes.io/managed-by": "Helm",
        "app.kubernetes.io/name": "argocd-application-controller",
        "app.kubernetes.io/instance": "contra-argo-cd",
        "helm.sh/chart": "argo-cd-5.16.1",
        "controller-revision-hash": "contra-argo-cd-argocd-application-controller-6bb78998f"
      },
      "pod_id": "caf529b8-b8a2-4c52-88cb-06199864a21f",
      "pod_name": "contra-argo-cd-argocd-application-controller-0",
      "container_image": "quay.io/argoproj/argocd:v2.5.3",
      "namespace_name": "argocd",
      "annotations": {
        "fluentbit.io/parser": "argo",
        "checksum/cmd-params": "9db39578862985b96a40db0b834f5031fdac7f8cfb5a4e0b0c246d3e56228e92",
        "container.seccomp.security.alpha.kubernetes.io/application-controller": "runtime/default"
      },
      "host": "gke-papaship-primary-pool-v2-5ea53227-2wgj",
      "container_name": "application-controller",
      "docker_id": "08da0d9dc979952e833c1c6411454f58402f6649bdeac30f2afe2e124b4d144d"
    },
    "dest-name": true,
    "dest-namespace": "argocd",
    "fields.level": "0",
    "time_ms": "6",
    "application": "argocd/contra-application-sets",
    "_p": "F",
    "message": "Reconciliation completed",
    "time": "2022-12-09T19:55:43.124764033Z",
    "dest-server": "https://kubernetes.default.svc"
  },
  "resource": {
    "type": "k8s_container",
    "labels": {
      "pod_name": "ontainers.contra-argo-cd-argocd-application-controller-0",
      "container_name": "application-controller",
      "namespace_name": "argocd",
      "project_id": "contrawork",
      "cluster_name": "papaship",
      "location": "us-central1-c"
    }
  },
  "timestamp": "2022-12-09T19:55:43Z",
  "severity": "INFO",
  "logName": "projects/contrawork/logs/stderr",
  "receiveTimestamp": "2022-12-09T19:55:47.947940050Z"
}

I would expect that given the configuration, jsonPayload.time field would be dropped. It seems to just duplicate contents of timestamp.

[agup006]

Hi @gajus, where is the processed log coming from? Potentially the time key is not found as a top level object where it then is not removed. Alternatively a Modify filter could help remove