How to calculate timediff of two fields in the same event

Elastic Stack Logstash
1

LOGSTASH - I would like to calculate time taken in seconds for two timestamps in the same event and store it in a different field say "e2e_latency_in_seconds".

The timestamps are in different format. I have successfully normalized them into one format and stored into elasticsearch however I am unable to create a new field using logstash plugin. Please help. I don't think I can use the elapsed plugin as it is for two different events but my case is just one event.

date{
	match => [ "tds_audittimestamp", "UNIX_MS"]
	target => "tds_audittimestamp"
}

date{
	match => [ "trade_insertion_at_source", "yyyy/MM/dd HH:mm:ss.SSS" ]
	timezone => "UTC"
	target => "trade_insertion_at_source"
	}

I have calculated using kibana scripted field but I want to achieve this in logstash as I cannot used scripted fields in Grafana.

screenshot

2

Try using the Ruby filter plugin:
https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html

3

I don't know ruby so found it very difficult. I have used below post to find the solution.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.