Rounding in Pipelines

[nick]

I don’t think Graylog has a Function for providing rounding of numbers.

I’ve attempted instead a horrible workaround but the substring part of the rule appears to be ignored.

Anyone see why?

I’m expecting something in the format 00.00

when

has_field("metricbeat_system_uptime_duration_ms")

then

//Maths

let time_ms = to_double($message.metricbeat_system_uptime_duration_ms);
let time_mins = time_ms / 60000.00;
let time_hours = time_mins / 60.00;
let time_days = time_hours / 24.00;


//Round Numbers

substring(to_string(time_days),0,4);
to_double(time_days);

//Create and set new fields

set_field("metricbeat_system_uptime_duration_mins", time_mins);
set_field("metricbeat_system_uptime_duration_hours", time_hours);
set_field("metricbeat_system_uptime_duration_days", time_days);

end

[shoothub]

I’ve already helped with similar problem, it can also work for you, please check my previous post:

Pipeline Rule: convert seconds to something readable

Very interesting problem, but with simple solution. I’ve created and tried this snippet and it works as expected. I’ve used function parse_unix_milliseconds to parse number of vpn duration in seconds as unix time. After that I only extracted hours, minutes and seconds using functions hourOfDay, minuteOfDay and secondOfDay and concat in one string. let vpn_duration = parse_unix_milliseconds(to_long($message.pulse_connectsec) * 1000); let vpn_hours = vpn_duration.hourOfDay; let vpn_minutes = vpn_…

[nick]

parse_unix_milliseconds requires a value of milliseconds since 1970. My input is just a count of milliseconds the server has been up.

Your code calculates the current hour, minute, second of a date.

I’m looking to convert ms into days, minutes, hours to two decimal places - not a date.

[nick]

Fixed

when

has_field("metricbeat_system_uptime_duration_ms")

then

//Maths

let time_ms = to_double($message.metricbeat_system_uptime_duration_ms);
let time_mins = time_ms / 60000.00;
let time_hours = time_mins / 60.00;
let time_days = time_hours / 24.00;

//Round Numbers

let time_days = to_double(substring(to_string(time_days),0,5));

//Create and set new fields

set_field("metricbeat_system_uptime_duration_mins", time_mins);
set_field("metricbeat_system_uptime_duration_hours", time_hours);
set_field("metricbeat_system_uptime_duration_days", time_days);

end

[nick]

Just to complete this, if you want to deal with having an unknown number of minutes but always two decimal places you can replace the Round Numbers line with the code below.

The code above always grabbed 5 characters which only works in the format xx.xx and not xxx.xx or anything above this.

//Round Numbers

let time_mins_split = split("\\.", to_string(time_mins)); //split mins by .
let time_mins1 = concat(to_string(time_mins_split[0]), "."); //minutes & .
let time_mins = to_double(concat(to_string(time_mins1), (substring(to_string(time_mins_split[1]), 0,2))));

let time_hours_split = split("\\.", to_string(time_hours)); //split hours by .
let time_hours1 = concat(to_string(time_hours_split[0]), "."); //hours & .
let time_hours = to_double(concat(to_string(time_hours1), (substring(to_string(time_hours_split[1]), 0,2))));

let time_days_split = split("\\.", to_string(time_days)); //split days by .
let time_days1 = concat(to_string(time_days_split[0]), "."); //days & .
let time_days = to_double(concat(to_string(time_days1), (substring(to_string(time_days_split[1]), 0,2))));

[nick]

Its worth noting that this still doesn’t round numbers, it just splits them to two decimal places.

0.567 will be 0.56 rather than the correct 0.57