String Timer
Description
This processor measures how long a value of a string field does not change. Once the value is changes the event with the measured time and the corresponding string value is emitted.
Required input
A string field is required in the data stream.
Field
The string field which is monitored for any value changes.
Configuration
Output Frequency
Define when an event should be emitted, either on each input event or just when the string value changes.
Output
The following two fields are appended to the event:
- [measured_time] the measured time for the string value to not change
- [field_value] the corresponding string value
The event is emitted whenever the value of the string field changes.