Elapsed questions


(shao-yu,wang) #1

i can count the elapsed time. but in kibana it just display the time count. i want to count time with difference user
the log is:
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: test|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: test|
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: jupyter|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: jupyter|

the filter is:
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged in: %{JUSER:jupyter_user}"
}
add_tag => ["taskStarted"]
tag_on_failure => [ ]
}
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged out: %{JUSER:jupyter_user}"
}
add_tag => ["taskEnded"]
tag_on_failure => [ ]
}
elapsed {
start_tag => "taskStarted"
end_tag => "taskEnded"
unique_id_field => "jupyter_user"
timeout => 1800
}


(Mark Walkom) #2

What do you mean?

You should really move this pattern file elsewhere. That's the directory Logstash assumes config files are, not pattern ones.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.