Let’s take two different events from a common stream. Both of the events have a field called “TotalSessionLength”. My purpose is quiet simple: I would like to sum the different values I have for each events, and put the result into a variable.
These MongoDB functions happen after the message arrives in Graylog. You are required to have an enterprise license to use these particular functions (according to docs) If data is consistently under 5GB a day that shouldn’t be an issue as you can apply for a free license.