String Field contains duration/conversion

Elastic Stack Logstash
1

Hello,

I have this string field "time.connected"
Examples:
image

How do I make this field in a duration field? is there a way to convert this?

2 
input {
  generator {
       message => "00:03:02"
	   count => 1
  }
 }
output {
  stdout {}         
}
filter {
	 ruby { code => "
	 duration = event.get('message')
	 seconds = duration.split(':').reverse.map.with_index.sum do |m, i| 
       m.to_i * 60 ** i
     end
	 event.set('duration', seconds) " }
}

Output:

"duration" => 182

2 Likes
3

Thank you @Rios !

1 Like