CODEWITHSUNDEEP
logstash
Chris
Chris

Reputation: 407

Averaging multiple fields in Logstash

I have an event that comes through with a variable number of fields { "dev_1": 12, "dev_2": 34, ... }. What logstash filters should I look at to produce an average of those fields, something like { "device_avg": 23 }?

I don't know the exact field names ahead of time. I will need to do some pattern matching to average all fields that match dev_* but I'm not sure if that is something I can do simply with an aggregate filter

Upvotes: 0

Views: 103

Answers (1)

Badger
Badger

Reputation: 4072

You would have to use a ruby filter. Try

    ruby {
        code => '
            total = 0
            count = 0
            event.to_hash.each { |k, v|
                if k =~ /^dev_/
                    count += 1
                    total += v.to_f
                end
            }
            if count > 0 ; event.set("average", total/count) ; end
        '
    }

Upvotes: 1

Related Questions