logstash - How to dynamically calculate a field value of current log entry from its preceding log entry? Or should this be done at kibana visualization side? -


my csv data format:

date   total -----  --- date1, 10 date2, 15 date2, 30 

i want logstash dates in timestamp field, "total" in total field (its easy upto part) want calculate "increment" field diffing "totals" previous log/csv entry. output this

date   total increment -----  ---   --------- date1, 10,   0 date2, 15,   5 date2, 30,   15 

also, if want visualise time difference between different log entries, how do that? tips highly appcreciated.

logstash doesn't provide in terms of correlation between events.

take @ elapsed{} filter, keeps cache of "start" events in order tag "end" events when arrive. use system in own filter compute running total.

if want current total, can aggregate , display sum in kibana.


Comments

Popular posts from this blog

python - No exponential form of the z-axis in matplotlib-3D-plots -

php - Best Light server (Linux + Web server + Database) for Raspberry Pi -

c# - "Newtonsoft.Json.JsonSerializationException unable to find constructor to use for types" error when deserializing class -