# AVAYA CDR analyses with ELK
**URL:** https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374
**Category:** Logstash
**Created:** [September 16, 2015, 9:00am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374 "2015-09-16T09:00:11Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 9:00am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/1 "2015-09-16T09:00:11Z")
Hi,
I've setup log stash to receive CDR from a avaya pabx.
Iv'e used the filter bellow:
filter {
if [type] == "cdr" {
csv {
separator =\> ","
columns =\> [
"call Start", "Connected Time", "Ring Time", "Caller", "Direction", "Called Number", "Dialed Number", "Account", "Is Internal", "Call ID", "Continuation", "Party1device", "Party1Name", "Party2Device", "Party2Name", "Hold Time", "Park Time", "AuthValid", "AuthCode", "User Charged", "Call Charge", "Currency", "Amount at last User Change", "Call Units", "Units at Last User change", "Cost per Units", "Mark up", "External Targeting Cause", "External targeter ID", "External Targeted Number"
]
}
}
}
Everything looks good, but i have some "issue".
For example, i would like to have a graph with call duration, but the graph don't looks correct.
do i have to convert the duration to a specific format ? integer or?
I have another issue, the ring\_Time is a value in second, but using a mean don't show the average ring time.
As i'm not programmer, any help would be appreciate.
Thx
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 16, 2015, 9:08am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/2 "2015-09-16T09:08:20Z")
Numerical fields should be integers or floats rather than strings. You can use the [mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) for that conversion:
```
filter {
mutate {
convert => {
"Connected Time" => "integer"
"Ring Time" => "integer"
}
}
}
```
Once that change has been made, subsequent messages will have the correct data type of those fields. However, the mapping for the current index can't be changed and in practice you won't see the change until a new index is created.
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 9:17am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/3 "2015-09-16T09:17:26Z")
Will try this
If i hunderstanc correctly, by default CSV are string ? Right ?
Thnks for you quick answer
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 9:29am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/4 "2015-09-16T09:29:14Z")
I'v just try but connected time was hh:mm:ss is now 0
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 16, 2015, 9:37am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/5 "2015-09-16T09:37:35Z")
> If i hunderstanc correctly, by default CSV are string ? Right ?
Yes.
> I'v just try but connected time was hh:mm:ss is now 0
Oh, I assumed that the columns actually contained numbers. An hh:mm:ss string needs to be converted to seconds to be useful in Kibana. I think you'll have to use the [ruby filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) to write a small snippet of Ruby to perform that conversion.
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 12:27pm UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/6 "2015-09-16T12:27:41Z")
I think i get it with the code bellow:
ruby { code =\> "event['Connected\_Time'] = event['Connected\_Time'] ? event['Connected\_Time'].split(':').inject(0){|a, m| a = a \* 60 + m.to\_i} : 0" }
i've set it to integer also after the ruby code.
but a query in kiban for "Connected\_Time":0 should show me all missed call return nothing .
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 16, 2015, 12:40pm UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/7 "2015-09-16T12:40:08Z")
I tried that filter with a plain stdout output and it looks good. Have you tried isolating things by ignoring ES and Kibana and just making sure that things look good with the stdout output?
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 12:50pm UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/8 "2015-09-16T12:50:52Z")
i'm sorry, you already lose me 😄
in kibana value looks to be good i a use a Connected\_Time:\* ( firts line 0, second 181, tird: 45
2015-09-16T12:20:08.206+02:00 I E208 Karl T9017 Line 17.3 1528449 2015/09/16 ... 208 0 3210756008 0 0 0 5
2015-09-16T12:21:31.137+02:00 I E223 Jordan T9017 Line 17.1 1528374 2015/09/16 ... 223 181 3210756023 0 0 0 3
2015-09-16T14:18:47.641+02:00 I E218 Malika T9017 Line 17.1 1533429 2015/09/16 ... 223 45 3210756023
but a query to Connected\_Time:0 return nothing.
What do you mean by can you exlain me a little more ?
> [@magnusbaeck](#):
>
> making sure that things look good with the stdout output?
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 16, 2015, 2:02pm UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/9 "2015-09-16T14:02:10Z")
i've modify the ruby code like this, so it created a new row "duration". not sure it's the right way to do it
And now i can filter on duration:0 :s
code =\> "event['Duration'] = event['Connected\_Time'] ? event['Connected\_Time'].split(':').inject(0){|a, m| a = a \* 60 + m.to\_i} : 0" }
---
### Author:  [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)
#### Post date: [September 17, 2015, 2:01pm UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/10 "2015-09-17T14:01:22Z")
Hi,
Every thinks lloks to work fine. Ithink that i had a issue with some fielsds, but copy it to another field with ruby looks to do the trick.
I have another question, i saw a geoip map.
Any idea if we can apply that kind of map to phone numbers to now which country is the most called or calee?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/avaya-cdr-analyses-with-elk/29374/11 "2017-07-06T05:28:48Z")