Elapsed questions

i can count the elapsed time. but in kibana it just display the time count. i want to count time with difference user
the log is:
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: test|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: test|
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: jupyter|
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: jupyter|

the filter is:
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged in: %{JUSER:jupyter_user}"
}
add_tag => ["taskStarted"]
tag_on_failure => [ ]
}
grok {
patterns_dir => ["/etc/logstash/conf.d/pattern"]
match => {
"loginout" => "User logged out: %{JUSER:jupyter_user}"
}
add_tag => ["taskEnded"]
tag_on_failure => [ ]
}
elapsed {
start_tag => "taskStarted"
end_tag => "taskEnded"
unique_id_field => "jupyter_user"
timeout => 1800
}

What do you mean?

You should really move this pattern file elsewhere. That's the directory Logstash assumes config files are, not pattern ones.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.