Logstash : How to compute endDate from startDate + duration

[cnico]

Hello,

I have an event in which its data is composed of a start dateTime and of duration in seconds.
I would like to compute via logstash, the end dateTime with the problem of day change if duration high.

Is possible to do that with some ruby code and how ?

Thank you,

[warkolm (Mark Walkom)]

This has been asked a few times, but yes, do it in ruby.
Have a search in this category and you will find some ideas

[cnico]

I did not find the exact use case in the forum, but searching on it and with some tries, here is my solution :

    date {
        match => [ "startTime", "dd/MM/YYYY HH:mm:ss.SSS" ]
        timezone => "Europe/Paris"
        target => "startTime"
    }
    
    ruby {
        init => "require 'time'"
        code => "
            durationInSeconds = event.get('durationMs').to_f / 1000;
            #Addition of duration must be in seconds here with a float number eventually for ms
            timeVal = Time.iso8601(event.get('startTime').to_s) + durationInSeconds 
            #Converts to logstash object of timestamp :
            event.set('startTime', LogStash::Timestamp.new(timeVal))
        "
    }

It works also with logstash 2.3 with the correct event manipulation as an array instead of getter and setter.