How can I create a new term by subtracting to other terms?


(tomer zaks) #1

Hi,

I have 2 terms X and Y. How can I create a third term Z that is X-Y in my logs through logstash?


(Magnus B├Ąck) #2

Use a ruby filter with the following code:

event.set('Z', event.get('X') - event.get('Y'))

This assumes that the X and Y fields are numeric.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.