Logstash filter duration calculation

Elastic Stack Logstash
1

in my log, each log line has action start time and action end time formatted as HHmmss.
I used the following code in the logstash filter.
It works well if the action lasts during the same day.
However, it runs into problems when the action end time passes midnight.
For example: this action's duration is 5 minutes
action start time 23:58:00
action end time 00:03:00 (i.e. the next day)
Then I get a wrong calculation (negative value).

I appreciate any help in solving this problem.

# get the duration of the action_time
     date {
            match => ["[action_start_time]", "HHmmss"]
            target => "[action_start_timed]"
            timezone => "America/New_York" 
       }
     date {
            match => ["[action_end_time]", "HHmmss"]
            target => "[action_end_timed]"
            timezone => "America/New_York" 
     }
     ruby {
            code => "event['action_duration'] = (event['action_end_timed'] - event['action_start_timed'])"
     }
1 Like
2

How about changing the Ruby code to add 24 hours if the resulting duration is negative?

3

I did that using

 ruby {
        code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
        code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"

}
and ruby plugin gave me an error stating it was expecting a string.

then I separated them and it worked:

 ruby {
        code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
 }
 ruby {
       code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"
 }