I am working with a set of devices that pushes data to my database every 5 minutes. The data contains a field with the device's id and a field with a float value.
Now, for every device I would like to substract the previous value from the current value, and add this value in a new field. I figured I would use the aggregate plugin to substract the values, but I am having trouble sorting the data on the device ids. A complicating factor is that the number of devices varies and can be quite large, so putting a bunch of aggregate filters in parallel is not feasible.
Is it possible to creat such a filter in logstash? Or is logstash not a suitable tool for this problem?
Thanks in advance!