I can use elapsed filter to create elapesd_time. Now, I want to create a alert like "V" or "X" if elapsed_time over 0.01 or not. Can I do that?
And I want to get right day of week with %{+E}, but it will reply with execute day.
1:
filter{
date{
match=>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
target=>"NewLogDateTime"
}
mutate{
add_field=>{"ActionState"=>" "}
add_field=>{"DayOfWeek"=>"%{+E}"}
}
if [Message]=="S"{
mutate{
copy=>{"Message" => "ActionState"}
add_tag=>["p_start"]
}
}
else if [Message]=="E"{
mutate{
copy=>{"Message" => "ActionState"}
add_tag=>["p_end"]
}
}
elapsed{
start_tag=>"p_start"
end_tag=>"p_end"
unique_id_field=>"TransactionID"
}
}
2:
filter{
date{
match=>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
target=>"NewLogDateTime"
}
mutate{
add_field=>{"ActionState"=>" "}
add_field=>{"alert_time"=>" "}
add_field=>{"DayOfWeek"=>"%{+E}"}
}
if [Message]=="S"{
mutate{
copy=>{"Message" => "ActionState"}
add_tag=>["p_start"]
}
}
else if [Message]=="E"{
mutate{
copy=>{"Message" => "ActionState"}
add_tag=>["p_end"]
}
}
elapsed{
start_tag=>"p_start"
end_tag=>"p_end"
unique_id_field=>"TransactionID"
}
if [elapsed_time]>=0.01{
mutate{
join=>{"alert_time"=>"X"}
}
else if [elapsed_time]<0.01{
mutate{
join=>{"alert_time"=>"V"}
}
}
Above two filter all "Configuration OK", but the 2 filter is going wrong like below：
[ERROR] 2018-05-23 14:52:15.984 [[main]>worker3] pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline_id=>"main", "exception"=>"undefined method >=' for nil:NilClass", "backtrace"=>["(eval):364:inblock in initialize'", "org/jruby/RubyArray.java:1734:in each'", "(eval):362:inblock in initialize'", "(eval):212:in block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:501:infilter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:477:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:439:inblock in start_workers'"], :thread=>"#<Thread:0x28a2ac73@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290 sleep>"}
Can someone teach me?