How to sum two field values from two different events together

Graylog Central (peer support)
1

Hi everyone,

Let’s take two different events from a common stream. Both of the events have a field called “TotalSessionLength”. My purpose is quiet simple: I would like to sum the different values I have for each events, and put the result into a variable.

Ex:
Event 1 : TotalSessionLength = 15
Event 2 : TotalSessionLength = 12

MyVariable = 15 + 12

I thought I could do it simply by using a rule but it looks like the rule can’t be performed on several events simultaneously.

Does anyone know how to figure out my problem? Thank you in advance.

Regards,

Clem.

2

You can look at storing values in Mongodb…

https://docs.graylog.org/en/4.0/pages/pipelines/functions.html#lookup-set-value

3

Hi @tmacgbay ,
Thank you for your answer. I will check if it can work. Does it require any Graylog sidecar or extension?

Regards,

Clem.

4

These MongoDB functions happen after the message arrives in Graylog. You are required to have an enterprise license to use these particular functions (according to docs) If data is consistently under 5GB a day that shouldn’t be an issue as you can apply for a free license.