1

Is it possible to create a message using values from two other messages in Graylog using only graylog's default functionality (such as pipelines and streams)?

For example, if two messages arrive in graylog 30 seconds apart:

{
    message:"view enter",
    timestamp:"2018-01-01 10:10:00.00"
},
{
    message:"view leave",
    timestamp:"2018-01-01 10:10:30.00"
}

I would like to create a third message with a field showing the difference between the two timestamp fields.

{
    message:"view visit duration",
    duration:30
}
Kanembel
  • 434
  • 4
  • 11

0 Answers0