Configure average

[romgo]

Hi,

I have a question, I’m currently graphing avg of apache response time.
My value looks like :

avg(response_time_ms) = 609.5384615384615

is there a way to configure it to not report something like :

avg(response_time_ms) = 609

My grok pattern for this field is %{NUMBER:response_time;int} and then I have a

Pipeline converting the value to ms :

rule "millieconds to microseconds"
when
  has_field("response_time")
then
    let response_time_ms = to_long($message.response_time) / 1000;
    set_field("response_time_ms", response_time_ms);
end

Thanks for your help.

[macko003]

Just few problems…

1. You copy only the NUMBERS from the messages. You should ide float, long, etc.
2. At the pipeline you DEVIDE the number. ??? What is you goal? 609/1000= 0.609. so you convert millisec to sec.
   If you loosed the data (microsec part of your response time you cant got it back.
3. You try to fill the information to an intiger field. ??? A long to integer. In a better situation you got 0. In worse you loose your message, because elasticsearch cant handle it.

So I suggest sit down, and think about your goals.

[romgo]

Hi,

thanks for your feedback.

we log apache2 request with parameter %D which is micro seconds I want to convert to millisec. Example was wrong sorry.

Proper value is like : 405118
which in ms is more readable : 405,118
You are right I want to do something like this :

rule "microseconds to milliseconds"
when
  has_field("response_time")
then
    let response_time_ms = $message.response_time / 1000;
    set_field("response_time_ms", response_time_ms);
end

but this syntax is wrong. I don’t know how to write it. To have some example ?

best regards

[macko003]

What your graylog tells at the error? Cover the red button with your cursor.

[romgo]

@romgo

rule “microseconds to milliseconds” when has_field(“response_time”) then let response_time_ms = $message.response_time / 1000; set_field(“response_time_ms”, response_time_ms); end

I got the same message as yours.

[shoothub]

Try to use:

    let response_time_ms = to_long($message.response_time) / 1000;

[romgo]

this works, it was my original configuration.
But the thing is I got results like :

avg(response_time_ms) = 609.5384615384615

I would like to round it like 609
is this possible ?

[shoothub]

I don’t have same problem, my value is correctly converted for example from 405118 ms to 405 seconds, and graphed correctly. Please send example of graph…

[romgo]

Here is what I got :

[romgo]

@shoothub I configured apache logs to send me timsestamp as ms, so this way I avoid any confusion with pipelines.

Looking at the average value I got exactly the same behaviour :

so my issue concern avg function. Is there a way to customize ?