feat: add timestamp tracking to flows with first_seen_at/last_seen_at/observed_at fields across all collectors

Add FIREWALL_LOG_TS_RE regex to parse timestamps from firewall log lines, implement firewall_log_seen_at to extract and convert log timestamps to UTC ISO format, add first_seen_at/last_seen_at/observed_at fields to flows in collect_packet_flows (AF_PACKET collector) with timestamp updates on flow aggregation, add timestamp fields to collect_flows (conntrack collector) and parse_firewall_log_line (
2026-07-10 14:44:42 +02:00
parent 757fecc686
commit 2509c4fa28
4 changed files with 66 additions and 4 deletions
@@ -94,6 +94,12 @@ function summarizeTraffic(traffic: Array<Record<string, unknown>>) {
      }
      if (!existing.observedAt && flow.observed_at) {
        existing.observedAt = String(flow.observed_at);
+      } else if (flow.observed_at) {
+        const existingTime = Date.parse(existing.observedAt || "");
+        const flowTime = Date.parse(String(flow.observed_at));
+        if (Number.isFinite(flowTime) && (!Number.isFinite(existingTime) || flowTime > existingTime)) {
+          existing.observedAt = String(flow.observed_at);
+        }
      }
      continue;
    }