Calculate timestamp duration to next document

[Tomo_M (Tomohiro Mitani)]

There is derivative aggregation, but there is no function like that for documents.

Perhaps Logstash Aggregation Filter could make it feasible somehow.

Though I'm not sure @@map is also usable in recent Logstash, this may also help you.

Keeping global variables in LS?!

Camden - Thx for sharing. Looking at this code with my beginner Ruby skills, it looks like you initialize a Map structure, into which you add a Year value which you extract from the Event's timestamp. The Else clause seems to replace all instances of Jan,Feb, .... Dec with the Year that you've stored in the map previously or current Year. I understand the concept in general. Some questions on your example: At what point in the config did you insert this section of the custom code? What …