Hi,
I'm struggling a few days in order to use aggregate filter to work (or i think it should work like this)
I have two lines, as follows
E.g:
08:00:45,585|73560708|ibwsin-tp-359|INFO|LoggerService||LogExecutionResult[81249983]|600BC03800C739DBCA030C000520|search-subscription|request| <?xml version="1.0" .*blablabla|0|
08:00:45,838|73560961|ibwsin-tp-359|INFO|end||Dispatcher[1944359640]|600BC03800C739DBCA030C000520|END|255.309853ms|OK
I'd like to merge these two lines, specifically get duration of this request (255.309853ms) and put it on a document in order to generate visualization into kibana.
I tried to do this configuration on logstash (apparently everything is ok), but i do not see how to agregate these data.
Here's my config:
filter {
mutate {
gsub => [ "message" , "[|]" , " "]
}
grok {
match => { "message" => "%{TIME:logTime} %{INT:random} %{NOTSPACE:thread} %{WORD:info} %{WORD:loggerservice} %{SPACE} %{NOTSPACE:logExecutionResult} %{NOTSPACE:tid} %{NOTSPACE:Service} %{WORD:loggerType} (?<dataXML>.*\<\/ib\-msg\>) %{GREEDYDATA:line}"}
match => { "message" => "%{TIME:logTime} %{INT:random} %{NOTSPACE:thread} %{WORD:info} %{WORD:loggerservice} %{SPACE} %{NOTSPACE:logExecutionResult} %{NOTSPACE:tid} %{WORD:loggerType} %{NOTSPACE:duration} %{GREEDYDATA:line}"}
}
mutate {
gsub => ["duration","ms",""]
convert => { "duration" => "float" }
}
if [loggerType] == "request" {
aggregate {
task_id => "%{tid}"
code => "map['duration'] = 0"
map_action => "create"
}
} else if [loggerType] == "END" {
aggregate {
task_id => "%{tid}"
map_action => "update"
code => "map['duration'] = event.get('duration')"
end_of_task => true
timeout => 10
}
}