# Two questions. Can I set condition with elapesd\_time? And according to logdatetime get right day of week?

**URL:** <https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932>\
**Category:** Logstash\
**Created:** [May 23, 2018, 6:57am UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932 "2018-05-23T06:57:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zxc654951](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zxc654951](https://discuss.elastic.co/u/zxc654951)\
**Post date:** [May 23, 2018, 6:57am UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932/1 "2018-05-23T06:57:03Z")

</div>

**I can use elapsed filter to create elapesd\_time. Now, I want to create a alert like "V" or "X" if elapsed\_time over 0.01 or not. Can I do that?**  
**And I want to get right day of week with %{+E}, but it will reply with execute day.**

**1:**  
filter{  
date{  
match=\>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]  
target=\>"NewLogDateTime"  
}  
mutate{  
add\_field=\>{"ActionState"=\>" "}  
add\_field=\>{"DayOfWeek"=\>"%{+E}"}  
}  
if [Message]=="S"{  
mutate{  
copy=\>{"Message" =\> "ActionState"}  
add\_tag=\>["p\_start"]  
}  
}  
else if [Message]=="E"{  
mutate{  
copy=\>{"Message" =\> "ActionState"}  
add\_tag=\>["p\_end"]  
}  
}  
elapsed{  
start\_tag=\>"p\_start"  
end\_tag=\>"p\_end"  
unique\_id\_field=\>"TransactionID"  
}  
}

**2:**  
filter{  
date{  
match=\>["LogDateTime", "yyyy-MM-dd HH:mm:ss.SSSSSS"]  
target=\>"NewLogDateTime"  
}  
mutate{  
add\_field=\>{"ActionState"=\>" "}  
add\_field=\>{"alert\_time"=\>" "}  
add\_field=\>{"DayOfWeek"=\>"%{+E}"}  
}  
if [Message]=="S"{  
mutate{  
copy=\>{"Message" =\> "ActionState"}  
add\_tag=\>["p\_start"]  
}  
}  
else if [Message]=="E"{  
mutate{  
copy=\>{"Message" =\> "ActionState"}  
add\_tag=\>["p\_end"]  
}  
}  
elapsed{  
start\_tag=\>"p\_start"  
end\_tag=\>"p\_end"  
unique\_id\_field=\>"TransactionID"  
}  
if [elapsed\_time]\>=0.01{  
mutate{  
join=\>{"alert\_time"=\>"X"}  
}  
else if [elapsed\_time]\<0.01{  
mutate{  
join=\>{"alert\_time"=\>"V"}  
}  
}

**Above two filter all "Configuration OK", but the 2 filter is going wrong like below：**  
_[ERROR] 2018-05-23 14:52:15.984 [[main]\>worker3] pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"undefined method `>=' for nil:NilClass", "backtrace"=>["(eval):364:in`block in initialize'", "org/jruby/RubyArray.java:1734:in `each'", "(eval):362:in`block in initialize'", "(eval):212:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:501:in`filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:477:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:439:in`block in start\_workers'"], :thread=\>"#\<Thread:0x28a2ac73@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290 sleep\>"}_

**Can someone teach me?**

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 23, 2018, 4:34pm UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932/2 "2018-05-23T16:34:36Z")

</div>

You are missing a } before the final else of filter 2 and also at the end.

---

<div class="post-metadata">

**Author:** ![zxc654951](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zxc654951](https://discuss.elastic.co/u/zxc654951)\
**Post date:** [May 24, 2018, 1:55am UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932/3 "2018-05-24T01:55:40Z")

</div>

**Thanks for your answer. I add missing } to filter coding, but still show error like below:**

_[ERROR] 2018-05-24 09:47:44.529 [[main]\>worker2] pipeline - Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"undefined method `>=' for nil:NilClass", "backtrace"=>["(eval):1999:in`block in initialize'", "org/jruby/RubyArray.java:1734:in `each'", "(eval):1997:in`block in initialize'", "(eval):920:in `block in filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:501:in`filter\_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:477:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:439:in`block in start\_workers'"], :thread=\>"#\<Thread:0x5607448a@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290 sleep\>"}_

**I try restart logstash, and it reply same error. Did it not get the `\>=' function? My reference is [https://www.elastic.co/guide/en/logstash/6.0/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/6.0/event-dependent-configuration.html). Did I write wrong code?**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2018, 1:55am UTC](https://discuss.elastic.co/t/two-questions-can-i-set-condition-with-elapesd-time-and-according-to-logdatetime-get-right-day-of-week/132932/4 "2018-06-21T01:55:40Z")

</div>

Closed on June 21, 2018, 1:55am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.