Hi,
I have the xml plugin running successfully on my data and can see our log files split out nicely in Kibana. What I need to do is convert a time field from this format:
00:00:00.0312000
Which I think is saying milliseconds, but I want to to be shown as seconds.
This field is produced by the XML plugin - so it is called "xml_content.Duration" - would it be accessible to logstash at this point? I tried to put a date filter after the xml filter but didn't see any difference.
Or is there a better place to do this conversion - Kibana scripted field maybe?
We want to graph the duration as a dashboard because long durations would indicate trouble in the system!
Thanks,
Fiona