Add 1 filed is sum of other field in logstash

[eperry (Ed)]

Try the aggregation filter

Aggregate filter plugin | Logstash Reference [8.11] | Elastic

Or you can always use the ruby filter if all fails

Ruby filter plugin | Logstash Reference [8.11] | Elastic

Sort of an example

Logstash Ruby filter to subtract difference between two timestamps in single event

Hi, I'm trying to demonstrate the feasability of switching from a Splunk solution to an ELK (Elasticsearch, Logstash and Kibana) stack (with Redis) solution for log analysis and triggering alerts. I have a requirement (due to a legacy application on a system with performace issues which is not the ELK stack server) to add a field at the time of indexing to events that shows the difference between two timestamps from the the same event (so I can't use the logstash elapsed filter plugin as that …