Convert Number (elapsed_time) into Time (HH:MM:SS)

[Thibaut_M (Thibaut Maire)]

Hello,

Let me expose what i'm trying to achieve here. I calculate an elapsed_time (with the elapsed plugin) between two documents. elapsed_time is in second and i want it like this : HH:MM:SS so as an example : 80 sec = 00:01:20 but i'm struggling to do this. At first, I tried in kibana with Scripted fields and follow the response of LeeDr in this link : JSON Input: Converting Minutes to Minutes and Seconds

But i got this error :

And I have document :

My elapsed_time fields is a number (like LeeDr response)

I tried then something else with the ruby filter without success...

This is my elapsed filter :

if [virtual_ip] == "IP adress" {
       elapsed {
            unique_id_field => "username"
            start_tag => "Connection started"
            end_tag => "Connection terminated"
            timeout => 86400
            add_tag => ["time_elapsed"]
       }
    } else {
      elapsed {
            unique_id_field => "username"
            start_tag => "Connection started"
            end_tag => "Connection terminated"
            timeout => 86400
            add_tag => ["time_elapsed_bis"]
       }
     }
    ruby {
            code => "event.set('duration_time', (event.get('elapsed_time').Time.utc.strftime('%H:%M:%S'))) rescue nil"

}

This ruby code doesn't work, I don't see any value in kibana for the field "duration_time"

I tried everything in the ruby code : just strftime('%H:%M:%S'), without "utc" but same result at the end.

Moreover I tried this

code => "event.set('duration_time', (event.get('@timestamp') - event.get('elapsed_timestamp_start')) / 60) rescue nil"

I get "duration_time" in minute but 2 minutes 30 secondes will be displayed as follow : 2.5 and this is not what i want

Could you please guys help me on this ? I don't know what else to try or if i'm doing something wrong

Thank you for your help
Thibaut

[Thibaut_M (Thibaut Maire)]

Anyone ?

[angelo]

In terms of Kibana and the error that you have in your screenshot, it's pointing out that you have some documents that have a missing value for elapsed_time and that you should do a check first. So with that and assuming that you want to allow hours to be larger than 24 (or else in a date/time format, that would increment the day field), here is an example:

if (doc['elapsed_time'].size()==0) {
    return ""
} else {
    long elapsed_time=(long)doc["elapsed_time"].value*1000;

    long secondsInMilli = 1000;
    long minutesInMilli = secondsInMilli * 60;
    long hoursInMilli = minutesInMilli * 60;
    long daysInMilli = hoursInMilli * 24;

    // long elapsedDays = elapsed_time / daysInMilli;
    // elapsed_time = elapsed_time % daysInMilli;/
	
    long elapsedHours = elapsed_time / hoursInMilli;
    elapsed_time = elapsed_time % hoursInMilli;

    long elapsedMinutes = elapsed_time / minutesInMilli;
    elapsed_time = elapsed_time % minutesInMilli;

    long elapsedSeconds = elapsed_time / secondsInMilli;

    String my_answer = String.format('%02d:%02d:%02d', new def[] {(int)elapsedHours, (int)elapsedMinutes, (int)elapsedSeconds});
    return my_answer;
}

I left elapsedDays as a comment just in case you did want to use it.

[Thibaut_M (Thibaut Maire)]

Hi Angelo,

Thank you for your answer.

I try to do what you said. I see that it is working in the preview

But it is not working. I get 0 value

Have I doing something wrong ? Is there an another option ?

Thank you for helping me
Thibaut

[Thibaut_M (Thibaut Maire)]

I found a solution by doing this

It displayed the time how i want but the field is in a date format, so i cannot use this to do an average or max vizualisation since it's not a number.

Angelo, in your script if i only let

if (doc['elapsed_time'].size()==0) {
return ""
} else {
doc["elapsed_time"].value*1000;
}

and keep this as a Number and not a date

I have my value multiply by 1000 (seems logic) but when i try to add the next piece of script that you gave, I have the 0 value that I show presviously

Thibaut