Iām posting @d2freak82 pipeline /w GROK.
"VPN sessiontime to min"
when
has_field("session_time")
then
let session_duration = to_string($message.session_time);
let vpn_duration = grok("%{UNIFIMS:UNWWANTED}", session_duration, true);
let d_time = to_long(vpn_duration.time);
let d_seconds = d_time % 60;
let d_minutes = (d_time % 3600 - d_seconds) / 60;
let d_hours = d_time / 3600;
let build_message_0 = concat(to_string(d_hours), " hours, ");
let build_message_1 = concat(build_message_0, to_string(d_minutes));
let build_message_2 = concat(build_message_1, " minutes, ");
let build_message_3 = concat(build_message_2, to_string(d_seconds));
let build_message_4 = concat(build_message_3, " seconds");
set_field("session_duration", build_message_4);
end