Hi,
I have a grok and I don't want to change it, but I wanted to have the hour and minutes separate, it could be using Ruby, something like that.
Thanks
else if "performanceLog" in [path]
{
grok
{
match => {"message" => "(?%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day}-%{TIME:date}) | %{USERNAME:username} | %{DATA:balcao} | %{DATA:server} | (%{DATA:transaction} | %{BASE10NUM:time}|%{GREEDYDATA:message})" }
overwrite => [ "message" ]
}
}
grok
{
break_on_match => false
match => {"path" => "(%{GREEDYDATA}/%{DATA:filename}_%{GREEDYDATA}.txt)|%{GREEDYDATA}"}
match => {"message" => "(?[\S]*Exception:)"}
}
mutate
{
add_field => {"logDate" => "%{year}-%{month}-%{day} %{date}"}
convert => {
"time" => "integer"
"conexoes" => "integer"
"ELKValue" => "integer"
}
}
ruby
{
code => 'event.set("timeGroup", ((event.get("time").to_f / 5).ceil) * 5)'
}
date
{
match => ["logDate", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}