I write some logstash filter the count the user online period.
but i got something wrong in my filter. And i don't know how to filter this by different users.
log format is
"|2017-09-28-09:49:18|INFO|JupyterHub|User logged in: jupyter|
|2017-09-28-09:49:24|INFO|JupyterHub|User logged out: jupyter|"
i write the filter like:
match => ["[action_start_time]", "yyyy-MM-dd-HH:mm:ss"]
target => "[action_start_timed]"
match => ["[action_end_time]", "yyyy-MM-dd-HH:mm:ss"]
target => "[action_end_timed]"
code => "event['action_duration'] = (event['action_end_timed'] - event['action_start_timed'])"