Converting Duration Field From Text To Number

[wwalker (Walker)]

I have a field that displays connection duration as a string that looks like 3h:49m:57s. Any ideas on how to convert this to an aggregateable format such as epoch time or something?

[Badger]

If you want to convert that to seconds you could do something like this (not tested):

grok { match => { "someField" => "%{INT:[@metadata][h]}h:%{INT:[@metadata][m]}:%{INT:[@metadata][s]}s" } }
ruby { code => 'event.set("duration", event.get("[@metadata][h]").to_i*3600 + event.get("[@metadata][m]").to_i*60 + event.get("[@metadata][s]"))' }

[wwalker (Walker)]

Oh wow, that's more than I expected! I should really learn Ruby better, I never think about it much. Unfortunately, after adapting it to the correct fields, I get an error Ruby exception occurred: String can't be coerced into Integer

[wwalker (Walker)]

Got it...had to convert the seconds field to an integer.

ruby {
  code => 'event.set("session_duration", event.get("[@metadata][h]").to_i*3600 + event.get("[@metadata][m]").to_i*60 + event.get("[@metadata][s]").to_i)'
}