Create nested field for aggregate plugin output?

Elastic Stack Logstash
1

I'm using the Aggregate plugin to calculate a value. I'm trying to set the value in a nested field, creating the field at the same time. My code is:

code => "event.set('[msg][duration]', event.get('[msg][time]') - map['begin'])"

[msg] exists before I call this code, but [msg][duration] does not. The code works, and creates [msg][duration] with an appropriate value. But the plugin raises an exception:

[2017-11-01T18:51:05,757][ERROR][logstash.filters.aggregate] Aggregate exception occurred {:error=>#<TypeError: NilClass can't be coerced into Fixnum>, :code=>"event.set('[msg][duration]', event.get('[msg][time]') - map['begin'])", :map=>{}, :event_data=>{"msg"=>{"build_id"=>315, "msg_type"=>"status", "seq_id"=>90, "time"=>1509562265, "version"=>1.0, "status"=>"succeeded"}, ...

What am I doing wrong? Is there a better way to return the calculated value in the intended field?

2

For me it looks like that the value of : "event.get('[msg][time]') - map['begin']" is null

Check it. Try for example to set an hard coded number.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.