I have an oracle ETL table that I am polling with the JDBC input and wanted to add a field as a calculation between the start and end time of the event which is logged in the same event.
Here is what I've tried:
filter {
if [type] == "etl" {
mutate {
id => "add_etl_index"
add_field => { "[@metadata][index]" => "active-etl" }
}
date {
id => "parse_etl_last_dttm"
match => [ "last_dttm", "ISO8601" ]
}
date {
id => "parse_etl_end_date"
match => [ "end_date", "ISO8601" ]
target => "end_date"
}
ruby {
id => "add_etl_duration"
code => "event.set('[duration]', event.get('[end_date]') - event.get('[last_dttm]'))"
}
}
}
But this produces the following Logstash error per event ingested:
[ERROR][logstash.filters.ruby ] Ruby exception occurred: no implicit conversion to rational from string
The event is still pushed to elasticsearch but without the desired "duration" field. Any help is most apprecieated.