Is it possible to increment or decrement a time field based on seconds and store it as another attribute?

Elastic Stack Logstash
1

Hi,

I am using ELK GA 5.0.0. I have a time entry like 06:52:02 and a delay entry (in seconds) like 1.016. I want to push another attribure to elasticsearch, by subtracting seconds from timefield, say 06:52:01 in this case. Is this possible?

Thank you.

2

With a ruby filter you could.

3

@warkolm , I am a beginner, could you kindly post the code?

Thanks in advance.. :slight_smile:

4

I don't know ruby, but if you have a search through the posts here you will find similar threads with examples.

5

Neither do I know ruby :disappointed:

It will be really helpful if someone like @magnusbaeck or @theuntergeek or @Christian_Dahlqvist look into it

6

Please don't ping other people like that, if you aren't willing to do a search and spend some time, why would they provide you a direct answer?
We do like to help, but you need to help yourself as well.

7

You're welcome.. 'll try myself..

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.