Elapsed filter: where is "elapsed_time" stored?

Elastic Stack Logstash
1

I have written elapsed filter and putting logstash in debug I am able to see it calculates correctly. How do i store it to a new field or does it get automatically stored somewhere?

add_field line in my code does not work. Have tried multiple options.

elapsed {
    unique_id_field => "msg_id"
    start_tag => "tds_start"
    end_tag => "tds_end"
    new_event_on_match => true
    timeout => 600
    add_field => {"tds_latency" => "%{[elapsed_time]}"}

}

[2017-12-13T06:44:05,388][DEBUG][logstash.pipeline ] output received {"event"=>{"@timestamp"=>2017-12-13T06:44:05.356Z, "@version"=>"1", "host"=>"sabre-rhel6.localdomain", "elapsed_time"=>[20.001], "msg_id"=>"ID:11561009-21-54584-163010", "tags"=>["elapsed", "elapsed_match"], "elapsed_timestamp_start"=>2017-12-13T06:43:43.134Z}}

2

Ignore. It was due to "new_event_on_match => true".

I turned it off and a new field got elapsed_time got created automatically!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.