elasticsearch/kiabana - 分析和可视化交易的总时间？

Question

使用logstash解析日志文件，这里是发送到elasticsearch的json看起来像：

对于包含事务开始时间的日志行，我添加db_transaction_commit_begin_time字段并记录它的时间。

{ 
          "message" => "2015-05-27 10:26:47,048 INFO [T:3 ID:26] (ClassName.java:396) - End committing transaction", 
          "@version" => "1", 
         "@timestamp" => "2015-05-27T15:24:11.594Z", 
           "host" => "test.com", 
           "path" => "/abc/xyz/log.logstash.test", 
       "logTimestampString" => "2015-05-27 10:26:47,048", 
          "logLevel" => "INFO", 
         "threadInfo" => "T:3 ID:26", 
          "class" => "ClassName.java", 
           "line" => "396", 
         "logMessage" => "End committing transaction", 
    "db_transaction_commit_begin_time" => "2015-05-27 10:26:47,048" 
} 

对于日志行contaning交易结束时间，我添加db_transaction_commit_end_time字段与它被记录的时间。

{ 
          "message" => "2015-05-27 10:26:47,048 INFO [T:3 ID:26] (ClassName.java:396) - End committing transaction", 
          "@version" => "1", 
         "@timestamp" => "2015-05-27T15:24:11.594Z", 
           "host" => "test.com", 
           "path" => "/abc/xyz/log.logstash.test", 
       "logTimestampString" => "2015-05-27 10:26:47,048", 
          "logLevel" => "INFO", 
         "threadInfo" => "T:3 ID:26", 
          "class" => "ClassName.java", 
           "line" => "396", 
         "logMessage" => "End committing transaction", 
    "db_transaction_commit_end_time" => "2015-05-27 10:26:47,048" 
} 

是否有可能来计算时间数据库交易（db_transaction_commit_end_time - db_transaction_commit_begin_time）其中ThreadInfo的是一样的吗？。我知道聚合可能会有所帮助，但我是新手，无法弄清楚。

如果以某种方式获得计算并存储在变量中的db_transaction_time。我如何可视化Kibana图表中的时间？

Answer 1

在logstash中使用elapsed{}过滤器。