I write some logstash filter the count the user online period.
but i got something wrong in my filter. And i don't know how to filter this by different users.
log format is
"|2017-09-28-09:49:18|INFO|JupyterHub|User logged in: jupyter|
......
|2017-09-28-09:49:24|INFO|JupyterHub|User logged out: jupyter|"
i write the filter like:
date {
match => ["[action_start_time]", "yyyy-MM-dd-HH:mm:ss"]
target => "[action_start_timed]"
}
date {
match => ["[action_end_time]", "yyyy-MM-dd-HH:mm:ss"]
target => "[action_end_timed]"
}
ruby {
code => "event['action_duration'] = (event['action_end_timed'] - event['action_start_timed'])"
}