Add stop timestamp base on previous doc (event)


(Martin) #1

Hello,

I push some events to elasticsearch with the following structure:

{
    "name": "status",
    "value": "active",
    "timestamp": "2018-01-01T00:00:00.000Z"
}

And when I receive a new event with the same name, like

{
    "name": "status",
    "value": "stopped",
    "timestamp": "2018-01-01T01:00:00.000Z"
}

I want to update the event status:active with a stopTimestamp field, like

{
    "name": "status",
    "value": "active",
    "timestamp": "2018-01-01T00:00:00.000Z"
    "stopTimestamp": "2018-01-01T01:00:00.000Z"
}

The final goal is to show events / transactions on a timeline, and the timeline require the field stop date

It is possible to have a document with a start and a stop date base on two previous events ?

Thanks

Martin


(Mark Harwood) #2

If you have lots of unique names to track see discussion on Distinct count with filter


(Martin) #3

Thanks

If I understand correctly, you suggest to do another index with my events with start stop from my events with only start.

How I can update automatically my new index ? I need to do an external script or I can have a "built-in" solution ?


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.