How can I create a new term by subtracting to other terms?

Elastic Stack Logstash
1

Hi,

I have 2 terms X and Y. How can I create a third term Z that is X-Y in my logs through logstash?

2

Use a ruby filter with the following code:

event.set('Z', event.get('X') - event.get('Y'))

This assumes that the X and Y fields are numeric.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.