Add duration ( seconds > 2 digits ) to timestamp with ruby filter

[Isilve28]

Hi ,

I checked this topic, this one and also this one and any of them resolved my problem.

I have start_time and I want to add duration (in seconds) in order to get end_time

I have duration in seconds like this : 5405,004 where 005 are milliseconds, and 5405 = 1 hour 30 minutes and 4 seconds.

I want to add them to start_time : 2019-01-17T09:14:26.5553520Z

I tried methods mentionned above, and I don't get the result I want ( 2019-01-17T10:44:30.5593520Z ).

Any idea to resolve my problem ? Thanks in advance !

[Badger]

You can parse the start_time with a date filter using ISO8601. After using mutate+gsub to convert the , to . you can grok the duration into a float. Having done that the following will get you

              "end" => 2019-01-17T10:44:31.559Z,

ruby {
    code => '
        t = event.get("ts").to_s
        event.set("end", Time.at( Time.iso8601(t).to_f + event.get("duration_as_float") ) )
    '
}

Joda time operations are only accurate to the millisecond. If you want to keep the additional 4 digits of precision you could parse them off the start time, convert the end time back to a string and append them.