Help with time based data

(Aylwinns) #1

Hi all,

I have the following log information.

MX_DATES | 2017/06/08 16:50:53 | 2017/06/08 16:55:57
MX_DATES | 2017/06/09 23:50:57 | 2017/06/09 23:57:23
MX_DATES | 2017/06/10 16:49:23 | 2017/06/10 17:00:12
MX_DATES | 2017/06/11 23:58:19 | 2017/06/12 00:10:09
MX_DATES | 2017/06/12 16:23:23 | 2017/06/12 17:00:48

I would like to use kibana line visualization for START & STOP on the same graph with the Y_AXIS being time and X-AXIS being the date of START_TIME.

The issue i have here is that some of the END is after 00:00:00 which means that the STOP is not always above the START and this causes the line visualization to be wrong.

I have a logic that might work but i am not sure if logstash is able to configure it that way.

Step 1 : create variables start_time and stop_time which are just the time in the START / STOP field
Step 2 : create variable start_date and stop_date which are just the date in the START / STOP field
Step 3 : create variable stop_time_adjusted
if [ start_date == stop_date ] then stop_time_adjusted=stop_time
if [ start_date != stop_date] then stop_time_adjusted=stop_time+24:00:00

Step 4: for the line creation we just start_time and stop_time_adjusted with start_date as x-axis

Step 1 and 2 are fine; step 3 is the one i am unsure about. I think it requires a lot of mutating to the correct data type.

If someone has a better method, please share ^^

Help would be greatly appreciated

(Guy Boertje) #2

There are some answers here:

The last answer was by Val Crettaz, a very knowledgable chap and a community maintainer of some plugins.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.