i have timestamp in data looks this: 0:00:00.000000
unfortunately supposed represent elapsed time, , elk stack doesn't seem that. need easy way convert long/float.
i've looked @ elapsed tag, i'm not sure want run through adding fake datetime on every iteration unit conversion. i've looked using ruby, doesn't seem strptime supported.
i don't know best solution, ended taking elapsed time field , using split. set new field to:
3600*[elapsed time][0] + 60*[elapsed time][1] + [elapsed time][2]
this way, timestamp of 0:01:28.214258 comes out 88.214258
Comments
Post a Comment