Pipeline computed Field

[graimato (Rino)]

Hello,
I wrote a pipeline to parse log files, I'm trying to create a computed field I have es.

• timerequest
• timeresponse

It is possible to create a new field latency

  {
        "set" : {
          "field" : "latency",
          "value" : "{{timeresponse - timerequest}}"
      }
    },
      {
        "convert" : {
          "field" : "latency",
          "type" : "float",
          "on_failure" : [
            {
              "set" : {
                "field" : "latency",
                "value" : -1
              }
            }
          ]
        }
      }

I do not want to use Enrich pipeline, I need a simple difference between fields

Is it possible?

best regards

[stephenb (Stephen Brown)]

Yes absolutely you just need to get the syntax correct

Assuming the one you are taking about is the latency it should look something like this you would use the painless scripting language.

You might need to guard it

{
 "if": "ctx.timeresponse != null && ctx.timerequest != null",
  "script": {
    "lang": "painless",
    "source": "ctx.latency = ctx.timeresponse - ctx.timerequest",
  }
}

[graimato (Rino)]

@stephenb
Thanks so much It works.
best regards