Calculate Date difference in LOGSTASH based on conditional text


(Shantanu Sen) #1

I have a condition here: I have a series of logs where it starts from startTransaction and ends at endtransaction. Now between there two events there are other logs.

My requirement is to capture the log time for the above mentioned events and calculate the difference.

As i read logstash do not support loop, there will be multiple blocks of start and end events, where I need to calculate the time difference.

Please help with some approach.


#2

What about elapsed plugin?
https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-elapsed.html


(Shantanu Sen) #3

How to add the calculated field ?


(Shantanu Sen) #4

elapsed {
start_tag => "eventstart"
end_tag => "eventend"
unique_id_field => "event_duration"
timeout => 600
new_event_on_match => false
add_field => { "event_duration" => "%{elapsed_duration}" }
}

This is not adding any field


(Leandro Sampaio) #5

Could use a ruby code... Its simples abd flexible.


(Shantanu Sen) #6

Can you give me some sample, i have never used ruby


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.