logstash - How to dynamically calculate a field value of current log entry from its preceding log entry? Or should this be done at kibana visualization side? -
my csv data format:
date total ----- --- date1, 10 date2, 15 date2, 30
i want logstash dates in timestamp field, "total" in total field (its easy upto part) want calculate "increment" field diffing "totals" previous log/csv entry. output this
date total increment ----- --- --------- date1, 10, 0 date2, 15, 5 date2, 30, 15
also, if want visualise time difference between different log entries, how do that? tips highly appcreciated.
logstash doesn't provide in terms of correlation between events.
take @ elapsed{} filter, keeps cache of "start" events in order tag "end" events when arrive. use system in own filter compute running total.
if want current total, can aggregate , display sum in kibana.
Comments
Post a Comment