elasticsearch logstash时差计算（ELK 5.3）

由于我的结束时间不同，我需要在不使用已用插件的情况下手动计算时间差&可能需要24小时才能完成大量日志。 我通过以下方式从旧日志中获取开始时间：

elasticsearch {
                query => "Event:'Sent' AND ID:%{[ID]}"
                index => "mylog*"
                result_size => "1"
                enable_sort => "false"
                fields => { "@timestamp" => "SentTime" }
        }

它实际上工作正常，并以“2017-03-29T22:00:03.000Z”格式返回正确的日期

但它的坏与： 返回此格式的值“1970年1月18日，08:07:09.056”

我确信这是一个微不足道的语法错误，但我无法捕捉到它。

通过以下数学运算解决：

elasticsearch {
                        hosts => ["Your elastic host"]
                        query => 'Event:"Sent" AND ID:"%{ID}"'
                        fields => { "@timestamp" => "SentTime" }
                        tag_on_failure => [ "NoSent_ID" ]
                }

             date {
                match => ["[SentTime]", "ISO8601"]
                target => "[SentTime]"
             }
        ruby {
                    init => "require 'time'"
                    code => "duration = (event.get('@timestamp') - event.get('SentTime')) rescue nil; event.set('Log_duration', duration); "
                 }

elasticsearch {
                        hosts => ["Your elastic host"]
                        query => 'Event:"Sent" AND ID:"%{ID}"'
                        fields => { "@timestamp" => "SentTime" }
                        tag_on_failure => [ "NoSent_ID" ]
                }

             date {
                match => ["[SentTime]", "ISO8601"]
                target => "[SentTime]"
             }
        ruby {
                    init => "require 'time'"
                    code => "duration = (event.get('@timestamp') - event.get('SentTime')) rescue nil; event.set('Log_duration', duration); "
                 }