I have an event in which its data is composed of a start dateTime and of duration in seconds.
I would like to compute via logstash, the end dateTime with the problem of day change if duration high.
Is possible to do that with some ruby code and how ?
This has been asked a few times, but yes, do it in ruby.
Have a search in this category and you will find some ideas
I did not find the exact use case in the forum, but searching on it and with some tries, here is my solution :
match => [ "startTime", "dd/MM/YYYY HH:mm:ss.SSS" ]
timezone => "Europe/Paris"
target => "startTime"
init => "require 'time'"
code => "
durationInSeconds = event.get('durationMs').to_f / 1000;
#Addition of duration must be in seconds here with a float number eventually for ms
timeVal = Time.iso8601(event.get('startTime').to_s) + durationInSeconds
#Converts to logstash object of timestamp :
It works also with logstash 2.3 with the correct event manipulation as an array instead of getter and setter.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.