elasticsearch/kiabana - 分析和可視化交易的總時間？

Question

使用logstash解析日誌文件，這裏是發送到elasticsearch的json看起來像：

對於包含事務開始時間的日誌行，我添加db_transaction_commit_begin_time字段並記錄它的時間。

{ 
          "message" => "2015-05-27 10:26:47,048 INFO [T:3 ID:26] (ClassName.java:396) - End committing transaction", 
          "@version" => "1", 
         "@timestamp" => "2015-05-27T15:24:11.594Z", 
           "host" => "test.com", 
           "path" => "/abc/xyz/log.logstash.test", 
       "logTimestampString" => "2015-05-27 10:26:47,048", 
          "logLevel" => "INFO", 
         "threadInfo" => "T:3 ID:26", 
          "class" => "ClassName.java", 
           "line" => "396", 
         "logMessage" => "End committing transaction", 
    "db_transaction_commit_begin_time" => "2015-05-27 10:26:47,048" 
} 

對於日誌行contaning交易結束時間，我添加db_transaction_commit_end_time字段與它被記錄的時間。

{ 
          "message" => "2015-05-27 10:26:47,048 INFO [T:3 ID:26] (ClassName.java:396) - End committing transaction", 
          "@version" => "1", 
         "@timestamp" => "2015-05-27T15:24:11.594Z", 
           "host" => "test.com", 
           "path" => "/abc/xyz/log.logstash.test", 
       "logTimestampString" => "2015-05-27 10:26:47,048", 
          "logLevel" => "INFO", 
         "threadInfo" => "T:3 ID:26", 
          "class" => "ClassName.java", 
           "line" => "396", 
         "logMessage" => "End committing transaction", 
    "db_transaction_commit_end_time" => "2015-05-27 10:26:47,048" 
} 

是否有可能來計算時間數據庫交易（db_transaction_commit_end_time - db_transaction_commit_begin_time）其中ThreadInfo的是一樣的嗎？。我知道聚合可能會有所幫助，但我是新手，無法弄清楚。

如果以某種方式獲得計算並存儲在變量中的db_transaction_time。我如何可視化Kibana圖表中的時間？

Answer 1

在logstash中使用elapsed{}過濾器。