Rounding float in ruby filter in logstash

Question

I am using 'elapsed' logstash filter to calculate time duration of an event. I need time in minutes instead of seconds, which is default in logstash. So, I'm using ruby filter for conversion but I am not able to round a float to two decimal places inside the ruby filter.

filter{
 ruby{
   code=>"event['elapsed.time']=event['elapsed.time']/60.0"
 }
}

I tried to use display format ".2f" but it doesn't work, probably because of the quotes. Using escape characters doesn't work either.

I also tried .round(2) on the float number, but the original value is retained.

Answer 1

I just had to do the same thing as far as rounding goes. All you need to do is wrap what's to the right of the = in ().round(2) like so:

(event['elapsed.time'] / 60.0).round(2)"

For me, I also needed to ensure that my field was a float to start with so I added a mutate filter. The result would be something like this:

filter{
 mutate {
   convert => [ "elapsed.time", "float" ]
 }
 ruby{
   code=>"event['elapsed.time'] = (event['elapsed.time'] / 60.0).round(2)"
 }
}

Answer 2

For those using logstash 5.0, with [breaking changes][1], the filter block would like:

filter{
    mutate {
        convert => { "total_time_cor" => "float" }
    }
    ruby{
        code=>"event.set('[elapsed.time]', (event.get('elapsed.time')/60.0).round(2))"
    }
    }

Answer 3

How are you deciding that it's not working? I'll bet by looking in elasticsearch, where you're probably fighting a mapping problem.

If you have an integer field, the division creates a float:

filter {

  ruby{
    code=>"
       event['time']=100

       event['time']=event['time']/60.0
    "
    }
}