Hi!
I want to calculate delta 2 events, use ruby to calculate delta time
This my config:
if [status] == "out"{
elasticsearch {
hosts => ["localhost"]
query => 'status:in AND username:"%{username}"'
fields => ["@timestamp","start"]
}
ruby{
init => "require 'time'"
code => "event['duration_hrs'] = (event['@timestamp'] - event['start']) / 3600 rescue nil"
add_tag => ["duration_hrs"]
}
But result duration => nil
===> "@version" => "1",
"@timestamp" => "2016-06-01T16:06:46.816Z",
"path" => "/opt/file1.log",
"host" => "archlinux",
"start" => "2016-06-01T16:06:23.769Z",
"username" => "linh",
"status" => "out",
"duration_hrs" => nil,
"tags" => [
[0] "duration_hrs"
if I use Time.parse().to_s or .to_f but ruby exception
ruby{
init => "require 'time'"
code => "event['duration_hrs'] =Time.parse (event['@timestamp']).to_s - Time.parse(event['start']).to_s"
add_tag => ["duration_hrs"]
}
==>
Ruby exception occurred: undefined method `gsub!' for "2016-06-01T16:04:42.483Z":LogStash::Timestamp {:level=>:error}
"@version" => "1",
"@timestamp" => "2016-06-01T16:04:42.483Z",
"path" => "/opt/file1.log",
"host" => "archlinux",
"start" => "2016-06-01T16:04:19.417Z",
"username" => "linh",
"status" => "out",
"tags" => [
[0] "_rubyexception"
]
I don't understands why wrong, can you help me?
Thanks