【Logstash】 I want to calculate the difference of field value


Monitoring server access logs with logstash.

want to do

Calculate the difference between the time field values ​​in the log (end_time-start_time). And I want to add the result to the new field as [support_time].


"00001~Product inquiry~2019-11-05 10:00:00~2019-11-05 10:10:00"
( [number)][business_type)][service_start_time)][service_end_time])

"00001~Product inquiry~2019-11-05 10:00:00~2019-11-05 10:10:00~00:10:00"


# Adding a new field to the access log can be done with "add_field".
# But, The description method of end_time-start_time is not known.

    mutate {
     add_field => {
       "support_time" => "what to write here ?"

It will not be a mutate filter, you will need to use ruby.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.