i can count the elapsed time. but in kibana it just display the time count. i want to count time with difference user
the log is:
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: test|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: test|
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: jupyter|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: jupyter|
the filter is:
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged in: %{JUSER:jupyter_user}"
}
add_tag => ["taskStarted"]
tag_on_failure => [ ]
}
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged out: %{JUSER:jupyter_user}"
}
add_tag => ["taskEnded"]
tag_on_failure => [ ]
}
elapsed {
start_tag => "taskStarted"
end_tag => "taskEnded"
unique_id_field => "jupyter_user"
timeout => 1800
}