Parsing execution metrics which are represented as TimeSpan

Elastic Stack Logstash
1

Hi,

I've got a log file with rows like this: Action1 took: 00:00:00.0320605
I would like to parse it and output to elasticsearh.
As far as I know there is no such type like TimeSpan, so I need to convert it to int or float.

I think I've got 2 options here:

  1. Change the logging and print number of seconds as well
  2. Convert the existing TimeSpan to seconds representation using the logstash filters

How can I achieve this?

2

You can use a grok filter to extract the hours, minutes, and seconds into separate fields, then use a simple ruby filter to combine them. Untested:

filter {
  grok {
    match => ["timespan", "%{INT:hours}:%{INT:MINUTES}:%{NUMBER:seconds}"
  }
  ruby {
    code => "
      event['elapsed'] = 3600 * event['hours'].to_f + 60 * event['minutes'].to_f + event['seconds'].to_f
    "
    remove_field => ["hours", "minutes", "seconds"]
  }
}
1 Like