Convert Microseconds to Milliseconds

[jwilson-chess (Jeremy Wilson)]

I have the following ruby code to do a conversion:

ruby {
    code => "event.set('redis.slowlog.duration.ms', event.get('redis.slowlog.duration.us').to_f / 1000)"
}

But it doesn't seem to produce any output:

I've tried adding an exception handler but it doesn't produce anything either. The data is being sent via filebeat using the redis slowlog prospector.

[Badger]

It works for me

"redis.slowlog.duration.us" => "12613",
"redis.slowlog.duration.ms" => 12.613

[jwilson-chess (Jeremy Wilson)]

Yes, everything says it should work but it isn't.

Here's the full logstash config:

input {
    beats {
        port => 5045
        host => "0.0.0.0"
    }
}

filter {
    if [fields][data_type] ==  "redis-slowlog" {
        date {
            match => [ "timestamp", "UNIX" ]
        }

        mutate {
            remove_field => ["headers","fields","type"]
            rename => ["host", "server"]
            convert => {"server" => "string"}
        }

        ruby {
            code => "begin
                        event.set('redis.slowlog.duration.ms', event.get('redis.slowlog.duration.us').to_f / 1000)
                        rescue Exception => e
                        event['ruby_exception'] = 'Exception:' + e.message
                     end"
        }

        if "_grokparsefailure" not in [tags] {
            mutate {
                remove_field => ["message"]
            }
        }
    }
}

output {
    if "redis-slowlog" in [tags] {
        elasticsearch {
            hosts => "localhost:9200"
            index => "redis-slowlog-%{+YYYY.MM.dd}"
        }
    }
}

And the filebeat config:

filebeat.modules:
- module: redis

filebeat.prospectors:
- type: redis
  hosts: ["localhost:6379"]
  fields:
    data_type: redis-slowlog

tags: ["redis-slowlog"]

output.logstash:
  hosts: ["10.0.0.76:5045"]

[guyboertje]

You could install the logstash-filter-math filter (docs).
You will need to convert any string based numbers to integers or floats first though.
Example:

    math {
      calculate => [
        ["fdiv", "[millimeters_f]", 25.4, "[inches]"]
      ]
    }