# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com
# Last Update: 12/9/2016

filter {
  ruby {
    code => "event.set('task_end', Time.now.to_f)"
  }
  ruby {
    code => "event.set('logstash_time', event.get('task_end') - event.get('task_start'))"
  }
  mutate {
    remove_field => [ 'task_start', 'task_end' ]
  }
  mutate {
	#add_tag => [ "conf_file_8998"]
  }
}
