I'm currently attempting to split a single activity SQL record with a start and end time into multiple documents in an index. Each document will have a single timestamp (and duplicated data fields) and each timestamp is 15 minutes apart: slicing up a compile run into multiple pieces. I know of no …

This code works! ruby { code => ' require "time" open_time = Time.at( event.get( "@opentimestamp" ).to_f ) close_time = Time.at( event.get( "@closetimestamp" ).to_f ) runidx = event.get( "runidx" ) i = …

Badger July 16, 2024, 6:21pm 5

Use Time.at. Example here.

Topic		Replies	Views
Compute difference between 2 timestamps Logstash	3	2611	July 12, 2017
How to consider multiple lines(starts with Timestamp all the time) as a single event? Logstash	4	662	May 8, 2017
Show cumulative duration between start / stop events Kibana	5	7674	July 6, 2017
Logstash to log file processing start and end time Logstash	3	652	December 14, 2020
Calculate time between different events with same ID Logstash	1	299	May 31, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Splitting Records With Start and End Times Into Separate Documents With A Timestamp Every X Minutes

Related topics