Increment @timestamp with a float field

Elastic Stack Logstash
2

You want to add duration or subtract it? Anyways, you can always take the long way around...

  ruby {
    code => 'event.set("[@metadata][timestamp]", (event.get("@timestamp") + event.get("duration")).strftime("%Y-%m-%dT%H:%M:%S.%LZ"))'
    id => "add_duration"
  }
  date { match => [ "[@metadata][timestamp]", "ISO8601" ] }
2 Likes