we have a logfile which holds following essential information:
timestamp, order_id, status_id
the order_id is identifying an order, which goes through different status during it's life.
Now I want to gather the information how long the order is inside which status.
What is the best way to hit this target? We are currently on following versions: Elasticsearch 1.6.0, Logstash 1.5.1, Kibana 3.1.1.
Idea 1: querying elasticsearch from logstash while processing the logmessage, requesting timestamp of previous status.
- is that possible? How?
Idea 2: Somehow to aggregate in post processing in kibana / elasticsearch
Idea 3: please tell me.