Using already provided time period


I have a bit of a problem here - i'm reseiving via syslog some data including uptime/downtime periods in format "HHhr:MMmin:SSsec".
There's no problem parsing it in an object like "downtime.<hr/min/sec>", but how do I use it as time units for further aggregations/calculations (for example - total downtime for 24 hours)?

A little example just to clarify:
Data: *blabla* was down for 23hrs:59mins:57sec
Pattern: %{}[a-z]*:%{NUMBER:f5_downtime.mins}[a-z]*:%{NUMBER:f5_downtime.secs}[a-z]*

I would use a ruby filter to convert them all to seconds and sum them

ruby {
    code => '
        total_downtime = 0
        hrs = event.get("").to_i
        if hrs
            total_downtime += hrs * 3600
        mins = event.get("f5_downtime.mins").to_i
        if mins
            total_downtime += mins * 60
        secs = event.get("f5_downtime.secs").to_i
        if secs
            total_downtime += secs
        event.set("", total_downtime)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.