Filebeat iis module time taken field

Using the filebeat iis module in v7.13, I cannot explicitly see the time taken field. Am I missing something or has it been replaced with event duration?
The iis logs exports all fields.

Yes and event.duration

So if you look at the definition of event.duration here

event.duration

Duration of the event in nanoseconds . If event.start and event.end are known this value should be the difference between the end and start time.

type: long
format: duration

So it looks like it is turned from ms (probably what the `ctx.temp.duration) it is multiplied by 1,000,000 in the pipeline to become nanoseconds.

Take a look at a discussion in this thread

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.