Calculate the difference between two fields with time

[akeelow]

Hello! One event has two fields ConnectTime and DisconnectTime. We need to calculate how long the event lasted. To do this, we need to subtract ConnectTime from DisconnectTime.

It seems to be very close to the solution, but I can not find a description of methods for events, which will help to convert text to time.

Filtr:

grok {
            match => { "message" => "<%{NUMBER:log_sequence}>%{NUMBER}: .%{SYSLOGTIMESTAMP:syslog_timestamp}: %%{WORD:facility}-%{INT:severity_level}-%{WORD:facility_mnemonic}: %{GREEDYDATA:message}" }
            match => { "message" => ", CallLegType %{INT:CallLegType}" }
            match => { "message" => ", ConnectionId %{WORD:ConnectionId}" }
            match => { "message" => ", SetupTime .%{TIME:SetupTime}" }
            match => { "message" => ", PeerAddress %{WORD:PeerAddress}" }
            match => { "message" => ", PeerSubAddress %{WORD:PeerSubAddress}" }
            match => { "message" => ", DisconnectCause %{INT:DisconnectCause}" }
            match => { "message" => ", DisconnectText %{GREEDYDATA:DisconnectText}" }
            match => { "message" => ", ConnectTime .%{TIME:ConnectTime}" }
            match => { "message" => ", DisconnectTime .%{TIME:DisconnectTime}" }
            match => { "message" => ", CallOrigin %{INT:CallOrigin}" }
            match => { "message" => ", ChargedUnits %{INT:ChargedUnits}" }
            match => { "message" => ", InfoType %{INT:InfoType}" }
            match => { "message" => ", TransmitPackets %{INT:TransmitPackets}" }
            match => { "message" => ", TransmitBytes %{INT:TransmitBytes}" }
            match => { "message" => ", ReceivePackets %{INT:ReceivePackets}" }
            match => { "message" => ", ReceiveBytes %{INT:ReceiveBytes}" }

            break_on_match => false
        }
        ruby {
            code => "event.set('DurationTime', (event.get('DisconnectTime').nil? || event.get('ConnectTime').nil?) ? nil :  event.get('DisconnectTime') - event.get('ConnectTime'))"
        }

Error:

[ERROR][logstash.filters.ruby    ][main][2a1af8dde985efdc0de41f59cdb87ca292a39edd280f7831799e47e51fabef35] Ruby exception occurred: undefined method `-' for "14:17:36.195":String {:class=>"NoMethodError", :backtrace=>["(ruby filter code):2:in `block in filter_method'"

[Badger]

You could start with

    ruby {
        code => '
            c = event.get("ConnectTime")
            d = event.get("DisconnectTime")
            if c and d
                c = Time.parse(c)
                d = Time.parse(d)
                event.set("DurationTime", d - c)
            end
        '
    }

but you may want to add heuristics to cope with transitions across midnight.

            "DisconnectTime" => "00:00:00.001"
            "ConnectTime" => "23:59:59.999"

will result in

  "DurationTime" => -86399.998,

[akeelow]

I think I've solved the midnight crossing problem

        ruby {
            code => '
                c = event.get("ConnectTime")
                d = event.get("DisconnectTime")
                if c and d
                    c = Time.parse(c)
                    d = Time.parse(d)
                    a = c > d ? 86400 : 0
                    event.set("DurationTime", d - c + a)
                end
            '
        }