IIS Event.Duration Doesn't seem Queryable?

[ELKNub (Dan Williams)]

Hey Folks,

So I'm looking to pull EVENT.DURATION out of the Logstash IIS preloaded filter. That's all in place and pulling fine.

However, you'll notice that it's pulling as an int, which is exactly what I want. The weird part is, I can't seem to pull ANYTHING when I ask to grab log entries below a certain level (remove the downtime pieces)

When I ask for event.duration < 4000 I get exclusively 0.0's back. When I add "And event.duration > 0.0" I get nothing back at all.

Any Idea's what's happening here?

[flash1293 (Joe Reuter)]

Hi @ELKNub,

could you share the mapping for your index (specifically for the event.duration field)?

[ELKNub (Dan Williams)]

Uh.... Maybe? Not sure I know how to do that.... My username checks out.

wait yes!

[ELKNub (Dan Williams)]

Figured it out!

Thanks for pointing me in the right place.

When I hit the edit button next to the mapping, it has an "input" and "output" section. The "Input" was set to nanoseconds, while the "Output" was set to milliseconds. While I didn't want to change either of these for fear of breaking shit, I DID realize that if I want to see counts under 10,000 ms (as they are displaying) I ACTUALLY need to add 6 zero's for converting to nanosecnds. So the filter "event.duration > 10000000000" works exactly how I need it. Thanks!

[flash1293 (Joe Reuter)]

Glad you got it to work, good job on figuring it out! It’s a little confusing the table is applying the format while the query isn’t, definitely good feedback