Hello!
I have a workflow and I want to know how much time pass from a value to another! For example in the next image with the field "filters" I want to know how much time pass from the value "Creacion" to "Tienda" in that case it seems doesn't pass any second but in the continuing with the workflow for example from "Tienda" to "Capturista" how much time it pass and then from "Capturista" to "Tienda" and so on from one to another!
Just to mention that the workflow will always start with the value "Creacion" but the rest of the values differ from one to another.
My idea was to in the table just put the time elapsed every second value, for example:
filters new field with the time elapsed
Creacion
Tienda --------------- (The time elapsed from "Creacion" to "Tienda")
Capturista ----------- (The time elapsed from "Tienda" to "Capturista")
Analisis Documental ----- (The time elapsed from "Capturista to "Analisis Documental")
Tienda -----------------(The time elapsed from "Analisis documental" to "Tienda)
Capturista --------------- (The time elapsed from "Tienda" to "Capturista")
Analisis Documental ----- (The time elapsed from "Capturista to "Analisis Documental")
And so on
This is my logstash config
input {
file {
path => "/Users/daniel/Documents/TRABAJO/Liverpool/Suburbia-Elastic/SuburbiaRendimientoFabrica20181205.txt"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
dissect {
mapping => {"message" => "%{solicitud};%{tienda};%{actions}"}
}
mutate {
gsub => ["actions", ";Tienda", "|Tienda", "actions", ";Creacion", "|Creacion", "actions", ";Capturista", "|Capturista", "actions", ";Analisis Documental", "|Analisis Documental" , "actions", ";APMWorkflow", "|APMWorkflow"]
}
split {
field => "actions"
terminator => "|"
remove_field => ["message"]
}
csv {
source => "actions"
separator => ";"
columns => ["accion", "accion_fecha", "user"]
remove_field => ["actions"]
}
date {
match => [ "accion_fecha", "yyyy-MM-dd HH:mm:ss" ]
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "suburbia"
document_type => "sub"
}
stdout { codec => rubydebug }
}
