I have a log which looks more less like this:
23/03/2020 8:15, mary, pc1154, SessionStarted, SessionID 1, Tools3 23/03/2020 9:00, john, pc2345, SessionStarted, SessionID 2, Apps1 23/03/2020 9:10, SessionID 1, SessionTerminated 23/03/2020 9:30, SessionID 2, SessionTerminated
I want to produce a report which would show duration of each session in the following form:
username, ClientMachineName, DeliveryGroup, SessionStartTime, SessionEndTime, SessionDuration john, pc2345, Apps1, 23/03/2020 9:00, 23/03/2020 9:10, 0:10 mary, pc1154, Tools3, 23/03/2020 8:15, 23/03/2020 9:30 1:15
I can use python to manipulate it outside Elastic, produce new document like in the second log and and index it back in.
However, Do you know if there is any solution to do such a transformation natively in Elastic/Kibana?