Hello team,
I'm trying to add a new field to metricbeat data collection through logstash. The idea is to create a field from the difference between two dates (@timestamp and system.process.cpu.start_date).
I've made some test, but the field created in elastic is empty.
logstash does not use the same syntax to refer to objects nested inside objects that filebeat documentation and elasticsearch use. In logstash that field would be referred to as
[system][process][cpu][start_time]
This allows logstash to unambiguously refer to fields that have . in their name.
That is going to take a string like "2021-03-29T04:24:52.000Z" and .to_i will just pull the leading 2021 from it. You need to parse that using a date filter to convert it to a LogStash::Timestamp (that's what a date filter always produces) so that .to_i returns a number of seconds.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.