Calculate Date difference in LOGSTASH based on conditional text

Elastic Stack Logstash
1

I have a condition here: I have a series of logs where it starts from startTransaction and ends at endtransaction. Now between there two events there are other logs.

My requirement is to capture the log time for the above mentioned events and calculate the difference.

As i read logstash do not support loop, there will be multiple blocks of start and end events, where I need to calculate the time difference.

Please help with some approach.

2

What about elapsed plugin?
https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-elapsed.html

3

How to add the calculated field ?

4

elapsed {
start_tag => "eventstart"
end_tag => "eventend"
unique_id_field => "event_duration"
timeout => 600
new_event_on_match => false
add_field => { "event_duration" => "%{elapsed_duration}" }
}

This is not adding any field

5

Could use a ruby code... Its simples abd flexible.

6

Can you give me some sample, i have never used ruby

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.