How can I create a new term by subtracting to other terms?

(tomer zaks) #1


I have 2 terms X and Y. How can I create a third term Z that is X-Y in my logs through logstash?

(Magnus B├Ąck) #2

Use a ruby filter with the following code:

event.set('Z', event.get('X') - event.get('Y'))

This assumes that the X and Y fields are numeric.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.