Logstash/grok to match only first occurrence and stop parsing repeatedly for same values

[theirfan]

That's helpful.

i have to calculate time difference between these two events as well, should i continue here or open a new topic?

Was looking into the forum for time difference between two timestamps and found one post in which you posted a solution, but that isn't working for me.

Time difference between two fields in a csv using ruby plugin

As the message says, you should be using event.get to access fields, and event.set to add them. For example, this code calculates the differences (in seconds) between two times. It does something slightly different to what you want, and comes from an aggregate filter, so is structured differently, but accesses and sets fields, so should give you some idea of what to do. code => " require 'time'; starttime = Time.iso8601(map['starttime'].to_s).to_f; endtime = Time.iso8601(event.g…

For reference, the same sample log ( as posted above ) , i need to get the total time in minutes and hours between two different readings. For example, how much time did the device stayed at 20.1 and 20.3 and so on.

please advice,