Create a field by doing arithmetic operation on two fileds

Elastic Stack Elasticsearch
1 
{
    "actualdatetime": "2016-May-19 00:00:00.965 +05:30",
    "messagedeliverytime": "Thu May 19 00:00:00 2016",
    "messagesubmissiontime": "Wed May 18 23:59:13 2016"
}

This is my actual document. I need a new field "latency" by doing

"(doc['messagedeliverytime'].value - doc['messagesubmissiontime'].value) / 1000"

And insert it as

{
    "actualdatetime": "2016-May-19 00:00:00.965 +05:30",
    "messagedeliverytime": "Thu May 19 00:00:00 2016",
    "messagesubmissiontime": "Wed May 18 23:59:13 2016",
   "latency":"47"
}

Is there any scripting which will run the calculation while indexing the documents and create the new field on the fly???

2

You should be able to do it with the script ingest processor, though you won't do it with doc, it'll look more like ctx['messagedeliverytime'] - ctx['messagesubmissiontime'] though you might need to do date parsing because at that point the dates may not be parsed. Have a look here for a reference on the available methods for parsing.

3

Can you show a small example for this??? How to parse before indexing. And how to put script in mapping

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.