I have the following log information.
JOB_NAME | START | STOP MX_DATES | 2017/06/08 16:50:53 | 2017/06/08 16:55:57 MX_DATES | 2017/06/09 23:50:57 | 2017/06/09 23:57:23 MX_DATES | 2017/06/10 16:49:23 | 2017/06/10 17:00:12 MX_DATES | 2017/06/11 23:58:19 | 2017/06/12 00:10:09 MX_DATES | 2017/06/12 16:23:23 | 2017/06/12 17:00:48 ...
I would like to use kibana line visualization for START & STOP on the same graph with the Y_AXIS being time and X-AXIS being the date of START_TIME.
The issue i have here is that some of the END is after 00:00:00 which means that the STOP is not always above the START and this causes the line visualization to be wrong.
I have a logic that might work but i am not sure if logstash is able to configure it that way.
Step 1 : create variables start_time and stop_time which are just the time in the START / STOP field
Step 2 : create variable start_date and stop_date which are just the date in the START / STOP field
Step 3 : create variable stop_time_adjusted
if [ start_date == stop_date ] then stop_time_adjusted=stop_time
if [ start_date != stop_date] then stop_time_adjusted=stop_time+24:00:00
Step 4: for the line creation we just start_time and stop_time_adjusted with start_date as x-axis
Step 1 and 2 are fine; step 3 is the one i am unsure about. I think it requires a lot of mutating to the correct data type.
If someone has a better method, please share ^^
Help would be greatly appreciated