logstash/logstash — pull request #713 by andreaforni (2013-10-09 15:37:47+00:00)
Title: New filter: elapsed

I wrote a new filter called "elapsed".

The elapsed filter tracks a pair of start/end events and uses their timestamps to calculate the elapsed time between them:

The configuration looks like this:

filter {
elapsed {
start_tag => "start event tag"
end_tag => "end event tag"
unique_id_field => "id field name"
timeout => seconds
new_event_on_match => true/false
}
}

Inside the filter file I wrote a longer and more detailed description. I wrote also a spec file.