Duration Functions

The Duration converter converts a duration string into a time.Duration type.

Hours, Microseconds, Milliseconds, Minutes, Nanoseconds and Seconds return a float64 value from a time.Duration type. These are different to the converters such as Minute, Hour, Day, Month, Year, Second, Nanosecond and Weekday converters, which extract a value from a time.Time type timestamp.

Syntax: Duration(string)

• string: A string to convert to a duration type.

Syntax: Hours|Microseconds|Milliseconds|Minutes|Nanoseconds|Seconds(value)

• value: a time.Duration.

Input

{
	"_type": "log",
	"attributes": {
		"Duration": "3596s",
		"user": "user68565"
	},
	"body": "<83>Dec 11 00:32:46 firewall02 %FTD-4-113019: Group = sales-group, Username = user, IP = 192.168.10.5, Session disconnected. Session Type: VPN, Duration: 3596, Bytes xmt: 204800, Bytes rcv: 153600, Reason: idle timeout",
	"resource": {...},
	"timestamp": 1733878055814
}

Statement

set(cache["inactive_hours"], Hours(Duration(attributes["Duration"])))
set(attributes["session_reason"], Format(" The session for %s has been terminated after %f hours of inactivity", [attributes["user"],cache["inactive_hours"]]))

See Working with a cache and Format.

Output

{
	"_type": "log",
	"attributes": {
		"Duration": "3596s",
		"session_reason": " The session for user68565 has been terminated after 0.998889 hours of inactivity",
		"user": "user68565"
	},
	"body": "<83>Dec 11 00:32:46 firewall02 %FTD-4-113019: Group = sales-group, Username = user, IP = 192.168.10.5, Session disconnected. Session Type: VPN, Duration: 3596, Bytes xmt: 204800, Bytes rcv: 153600, Reason: idle timeout",
	"resource": {...},
	"timestamp": 1733878120460
}

The session_reason attribute was calculated by converting the session duration from seconds to hours using the Hours function, which converts a given duration into hours. The Format function was then used to construct a descriptive message that incorporates both the username and the calculated inactive hours, enhancing the log’s clarity and usefulness for monitoring and analysis purposes.

The Duration function was necessary because the “Duration” attribute in the log’s attributes was provided as a string in the format “3596s”. To use this duration with the Hours function, which requires a time.Duration type as input, it was essential to first convert the string representation of the duration into an actual time.Duration type.