Copy a date from a filed to a second field

[sbruyere (Stephan Bruyere)]

Hi,

I need to pass date from a filed to an other to measure time gap between two log file received via Http_poller.
I use the Memory plugin and Logstash 5.1.

Here what I've tried :
if [ColName1] == "Log Time" {
memorize {
fields => [ "This_Log_Arrival", "Previous_Log_Arrival" ]
}
mutate {
rename => {"This_Log_Arrival" => "Previous_Log_Arrival"}
}
mutate {
add_field => {"This_Log_Arrival" => "%{@timestamp}"}
}
}

The result of all my tests gave Previous_Log_Arrival = This_Log_Arrival.

Pleae help

[sbruyere (Stephan Bruyere)]

Ok, I found my mistake/misunderstanding. The memorize plugin -I believe- cannot memorize anything between two Http_pollings. It just memorizes fields and passes them between events of a single Http_polling.

And I also understood that what I was looking for -Finding the Timestamp of the last entry in Elastic- was easily done with logstash-filter-elasticsearch.