# Keeping a Constant variable across Log events?

**URL:** <https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693>\
**Category:** Logstash\
**Created:** [November 26, 2015, 10:07pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693 "2015-11-26T22:07:22Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [November 26, 2015, 10:07pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/1 "2015-11-26T22:07:23Z")

</div>

Hello,

I want to have a constant value available for all the events getting processed by Logstash.  
So for example, I want to calculate the unique session IDs based on the Epoch time of the first event. Then subsequent events will be the addition of these base epoch time and the sessions ID which are unique for a day.

```
[2015-Nov-18 08:49:11.968159 -0600]: <info> L3Z3-02 L3Z3-02 Starting...
[2015-Nov-18 08:50:24.431304 -0600]: <ui> L3Z3-02 0 2 Bilingual NORMAL TOUCH TIMELINE SET_STATE ECMS:atrocity/10 STATE:SINGLE_ATTRACT

```

Want to calculate the `session ID of the UI event = base Epoch time from the INFO event + 2`

Here is my code:

```
if [logLevel] == "info" and [status] == "Starting" {
 ruby {
     code => "require 'date'
        epochBase = DateTime.parse(event['timestamp']).to_time.to_i
        epochBase = (epochBase*10000000)/60"
     add_field => { "epochBase" => "%{epochBase}" }
  }
}

```

Then for other UI events I am trying to use the epochBase field like so:

```
ruby {
    # Recalcualting the session IDs EpochTime/60
    code => "
        epochTime = event['epochBase'] + event['sessionID'].to_i
        event['sessionIdentifier'] = epochTime.to_s"
}

```

But I know this will not work because the epochBase does not persist across events. Is there any way around this?

Thanks to the community here.

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [November 27, 2015, 6:01pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/2 "2015-11-27T18:01:25Z")

</div>

I am open to any other suggestions on the solution to this problem. Thanks

---

<div class="post-metadata">

**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\
**Post date:** [November 27, 2015, 6:53pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/3 "2015-11-27T18:53:45Z")

</div>

There is probably a more direct approach, but logically this is how I imagine it:

You want an epoch time that is unique each day and are shared among all events of that day. So to calculate your base epoch, only take the %d/%m/%Y and discard the rest.

> irb(main):002:0\> require 'date'  
> =\> true  
> irb(main):003:0\> now = DateTime.now()  
> =\> #\<DateTime: 2015-11-27T13:49:00-05:00 ((2457354j,67740s,918374000n),-18000s,2299161j)\>  
> irb(main):005:0\> today = now.strftime("%d/%m/%Y")  
> =\> "27/11/2015"  
> irb(main):006:0\> epoch\_base = DateTime.strptime(today, "%d/%m/%Y").to\_time.to\_i  
> =\> 1448582400  
> irb(main):007:0\> puts epoch\_base  
> 1448582400  
> =\> nil  
> irb(main):008:0\>

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [November 27, 2015, 8:27pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/4 "2015-11-27T20:27:40Z")

</div>

Thanks for the reply.

Yes I can do this, but I do not want to do this for every event that comes across in the pipeline. Is there any way to do this once and make the value available for events?

---

<div class="post-metadata">

**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\
**Post date:** [November 27, 2015, 8:41pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/5 "2015-11-27T20:41:18Z")

</div>

I doubt it. Once an event has passed through LS, LS can no longer reference it (not in way I've used anyway).

---

<div class="post-metadata">

**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Post date:** [November 28, 2015, 4:45pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/6 "2015-11-28T16:45:18Z")

</div>

Maybe you can use aggregate filter :  
When start event occurs, you compute session I'd, and you store it in aggregate map until the end of the session in the logs.  
At the session end (in the logs), you delete the map, using end\_of\_task=true

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [November 30, 2015, 3:43pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/7 "2015-11-30T15:43:40Z")

</div>

Sure, I will give this a try. Thanks for the tip!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693/8 "2017-07-06T05:20:46Z")

</div>

Closed on July 6, 2017, 5:20am UTC