Converting elapsed time 00:00:00:XXXXXXX

[dsever (Dubravko)]

Hi there,

I have small problem with small problem with preparing elapsed time for executing db procedure.
For instance using grok as %{TIME:elapsed} and it matches ok, but at eleastic it provides me value as string.
for example:
"elapsed"=> "00:00:00.0029343" and it is represented like string, and I'm trying to have it in date format
like 00:00:00:XXXXXXX.

Probably it is possible using mutate filter, but I'm not sure how can I use it with date formats.

Any instruction would be useful

EDIT: resolved by using template, and converted to format 1970-01-01 HH:mm:ss.SSSSSSS

Thanks
Dubravko

[fbaligand (Fabien Baligand)]

Another way to do that (compared to elasticsearch template), is to use Logstash "date" filter.

That said, I'm surprised that you try to convert a duration to a timestamp.

[dsever (Dubravko)]

I've already tried by using date, in that case:
target => fields will extend it with "date xx:xx:xx.SSSSSSS" where date is today (just to be sure I will try ones again)

So decide to fixed it to unix time.

Dubravko