I am trying to index events that occur at different times in different invervalls.
There are 2 servers and between them is a middleware. Server A sends a request to do a certain job. Server B is handling this request and executes the job. After the job is done it sends a response. My job is to correlate this events. I do know when Server A sends his request (timestamped),
I know when Server B sends his response (timetamped) and i can correlate them, because they share an id.
I do not know, if Server B is going to send a response (maybe smth failed). I do not know when in future the answer will come ... 100ms or maybe 1 hour (depens on the job / task)...
So, I got this log-file (and later on a stream) and I want to correlate now. My idear would be to
- the request (at request)
- the response (at response)
- the correlatet data (at response)
But for now I only can index the request and the response. I know that I can clone an event (clone the response), but I do not know how to edit this clone or smth like this.
Do you have any idears about what would be a good idear to solve this with logstash?
I thought about a small C++ prog. which sends 2 events at logstahs when a response got send from Server B, but would this be best practice?
Thanks for your help and sorry for my english