input {
file {
path => "C:\Users\egupanm\csv\logs.log"
start_position => "beginning"
}
}
filter {
grok {
match => [ "message", "(?< timestamp >%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}) %{LOGLEVEL:log_level} %{NUMBER:line:int}" ]
}
ruby {
code=> " hr=event['hour'].to_i ;
min = event['minute'].to_i ;
sec = event['second'].to_i;
hr_to_sec = hr * 60 * 60;
min_to_sec = min * 60;
event['time']= hr_to_sec + min_to_sec + sec ;
event['message']= var2;
event['difference'] = event['time'].to_i - var1;
var1=event['time'].to_i ;
var2 =event['log_level'];
event.cancel if event['difference'] <= 20"
}
mutate {
remove_field => ['year']
remove_field => ['month']
remove_field => ['day']
remove_field => ['hour']
remove_field => ['minute']
remove_field => ['second']
}
}
output
{
stdout {
codec => rubydebug{}
}
}
Through this config i am trying to add those event in which time gap is more than 20 seconds and corresponding log level .
Now i want to replace logstash @timestamp with my timestamp field so that i can see that in kibana.
What should i possibly add? because i had to break my timestamp in order to get difference so date filter pattern is not matching so please tell me the pattern ..
my timestamp looks like this: 2015-10-21 12:31:56
Please help