logstash/logstash — pull request #707 by jdve (2013-10-08 14:44:21+00:00)
Title: filters: elasticsearch: new filter for querying es

Sometimes it's useful to be able to correlate new events with previous
events (e.g., to calculate time duration between events). This filter
queries an elasticsearch host to find the top event matching the given
search criteria and copies specific fields from that event into the new
event.

Here's an example that will determine when an operation started and
store that timestamp into the ending event:

if [type] == "end" {
elasticsearch {
host => "es-server"
cluster => "es-cluster"
query => "type:start AND operation:%{[opid]}"
fields => ["@timestamp", "started"]
}

date {
match => ["[started]", "ISO8601"]
target => "[started]"
}
}