Logstash workflow with calculation

I am looking to implement the following workflow:
Take data from ActiveMQ with passes me a number of fields. One field that I get passed is called APID.
APID is sent with each JSON message and can be equal to a number.
In next output, APID can be 10, then in next 20, then 10, then 40, then 10, etc...
I need to keep track of each APID sent to me(in memory if possible) and if the same APID is sent, calculate time (interval time), between the last APID of value 10 and current APID of value 10.
For example:
Packet = 1
APID = 10
Time = 01/03/2018 14:10:00
IntervalTime= null

Packet = 2
APID = 20
Time = 01/03/2018 14:20:00
IntervalTime= null

Packet = 3
APID = 10
Time = 01/03/2018 14:30:00
IntervalTime= 20 sec

Packet = 4
APID = 20
Time = 01/03/2018 14:40:00
IntervalTime= 20 sec

Is it possible to calculate this in Logstash?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.