I have mysql input via jdbc plugin which has a bunch of incremental values (per minute) for some fields like below
'timestamp' 'id' 'value1' 'value 2' ....
00:00 1 10 14
00:00 2 13 17
00:01 1 12 18
00:01 2 16 20
So at minute 0, id1 had values 10 and 14 and at minute 1 they became 12 and 18. I want to calculate the difference between these values every minute. So for id1, value1diff = 2 and value2diff = 4 and so on for each id and each value per minute.
Right now I can do this by separately processing each value in a ruby filter like
init => "@@prev_value1 = -1
@@prev_value2 = -1"
code => "
if (@@prev_value1 == -1 and @@prev_value2 == 1)
delta1 = 0
delta2 = 0
delta1 = event.get('value1') - @@prev_value1
delta2 = event.get('value2') - @@prev_value2
@@prev_value1 = event.get('value1') @@prev_value2 = event.get('value2') " }
But this will balloon up as soon as I try to do it for more values and more ids. Is there a way to handle such delta calculation via array or something? I am trying to find the best way to handle this task because I need to be processing upto 8 ids and 14 values.