Trying to Compare two timestamps to calculate ingestion speed

Elastic Stack Kibana
,
1

Hello!
I am in the process of attempting to create a column which tells me the difference between the time the log was created in elastic (so the ingestion time stamp) and the timestamp against my IIS log(so the iis.access.time).

This is currently what i have in my SCRIPT pipline.

def ingested = ctx.event.ingested;

def created = ctx.iis.access.time;

ingested = ZonedDateTime.parse(ingested);

ctx.event.ingestionspeed = ChronoUnit.SECONDS.between(created, ingested);

Thank you in advance.

2

Hi

So while this is more a Elasticsearch topic, I try to help , didn't test, but I think you need also to parse ctx.iis.access.time before you can calculate the seconds between created and ingested?

BTW you could also do it with a runtime field:

but of course, doing it before document is ingested is better for performance.

Best,
Matthias

3

Hello - Thank you for your response.
I have managed to do what i needed in the end. by converting both to a datetime I was then able to compare the two and get the difference.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.