Logscape Support

Synthetic fields are great - really powerful! Allowing you to transform data in useful ways with a little groovy.

I find that the two problems I run into are:

1. With all the things I could do, what should I do to get the best data?

2. I know I did some brilliant groovy last week... I just have to check all my data types until I can find it again!

So I thought we could have a thread here, with useful little groovy snippets for synthetic fields along with uses. If you think it could be done more efficiently or see another use for something, throw it in! That way, we only have to check this thread rather than the ever expanding list of data types.

Clean Percentage

I want to know what % of my licences are currently in use - with only 2 decimal places

groovy-script:

def pct = licensesUsed / licensesTotal * 100

return new Double(pct).round(2)

Time Since

I want to know the time in seconds since an event occurred - in this case dateTime is the timestamp provided on the log line. 

groovy-script:

def a = new Date().parse("yyy-MM-dd HH:mm:ss,SSS",dateTime)

def b = new Date()

def c = new Date(b.time - a.time) 

def d = c.time / (1000)

return d

Time Between

I want to know the time in seconds between two time stamps - make sure you parse the date formats correctly. 

groovy-script:

def a = new Date().parse("yyy-MM-dd HH:mm:ss,SSS",date1)

def b = new Date().parse("yyy-MM-dd HH:mm:ss,SSS",date1)

def c = new Date(b.time - a.time) 

def d = c.time / (1000)

return d

Boolean Status Indicator

I want to know whether a specific event has occurred in this log line, in this case whether the msg field contains the world died and the level field is WARN. It will produce a 1 if true, 0 if not.  

groovy-script:

return (msg.contains(":Died") && level.contains("WARN")) ? 1 : 0