{
"offset" => 80223,
"prospector" => {
"type" => "log"
},
"doc" => {
"Time" => "2018-03-03T10:38:06.2677861+00:00",
"Level" => "Info",
"User" => "TaGer1",
"Method" => "Utilities.DefaultLogs.CommandUsageLog::Info",
"AppDomain" => "DefaultDomain [1]",
"Message" => [
[0] "3D3D3D3D-3D3D-3D3D-3D3D-3D3D3D3D3D3D",
[1] "CloseND",
[2] "Session GUID: f0817cea-63ee-4d6d-a7fa-ab47404b91aa",
[3] "Time (ms):",
[4] "135625",
[5] "Case:",
[6] "7515ebae-5918-4e9a-b59c-5c246028a0e9"
],
"Thread" => "[1]",
"Host" => "DESKTOP-S3T0CB1",
"Categories" => "client.performance.commands, common.assembly.utilities"
},
"filetimestamp" => "19.3.3.3465.20180303.0",
"host" => "LKP-C-SI-SET-1",
"@timestamp" => 2018-05-02T11:47:29.200Z,
"source" => "C:\\Users\\si-set\\Desktop\\CommandUsage\\Commandusage.w3wp.default.19.3.3.3465.20180303.0.slf",
"Bloat" => "3D3D3D3D-3D3D-3D3D-3D3D-3D3D3D3D3D3D\tCloseND\tSession GUID: f0817cea-63ee-4d6d-a7fa-ab47404b91aa\tTime (ms):\t135625",
"path" => "C:\\Users\\si-set\\Desktop\\CommandUsage",
"logtype" => "Commandusage",
"@version" => "1",
"beat" => {
"name" => "LKP-C-SI-SET-1",
"version" => "6.2.2",
"hostname" => "LKP-C-SI-SET-1"
},
"Case" => "7515ebae-5918-4e9a-b59c-5c246028a0e9",
"CommandID" => "CloseND",
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
]
}
If the CommandID is CloseND we want to grokparse the Time (ms): from Bloat, preferably as a number and not a string if it doesn't have a significant impact on performance.