Using the filebeat iis module in v7.13, I cannot explicitly see the time taken field. Am I missing something or has it been replaced with event duration?
The iis logs exports all fields.
Yes and event.duration
So if you look at the definition of event.duration here
event.duration
Duration of the event in nanoseconds . If event.start and event.end are known this value should be the difference between the end and start time.
type: long
format: duration
So it looks like it is turned from ms (probably what the `ctx.temp.duration) it is multiplied by 1,000,000 in the pipeline to become nanoseconds.
Take a look at a discussion in this thread
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.