I need to calculate the object allocation rate in the jvm. That value can be derived from the jvmlogs. If I subtract the "heapBeforeGC" field in one line from the “heapAfterGC” field in the previous line and divide it by the elapse time I can get a good estimate for how many bytes we allocate in the jvm per unit of time.
I need to trend that value.
Delta provides a diff between the same field in adjacent events. What can I use to diff different fields in adjacent events, and then trend that?
Here are couple of log lines:
2010-05-11T00:09:26.079+0000: 325107.330: [GC [PSYoungGen: 451418K->42291K(453312K)] 1847697K->1438569K(1874624K), 0.0203820 secs] [Times: user=0.25 sys=0.01, real=0.02 secs]
2010-05-11T00:09:29.776+0000: 325111.027: [GC [PSYoungGen: 453299K->45942K(460864K)] 1849577K->1442220K(1882176K), 0.0228840 secs] [Times: user=0.27 sys=0.01, real=0.03 secs]
I want to diff the fields in bold for successive events
My delta needs to be: B from time2 minus A from time1. If I eval both fields to the same variable, how do I differentiate? Can u give me an example please?
UPDATE: What you want to do, is use streamstats and eval, as in the following.
| streamstats current=f first(heapAfterGC) as previousheapAfterGC | eval difference=heapBeforeGC-previousheapAfterGC
Neither delta nor autoregress will be of much use to you.
Delta makes a lot of sense, except that it seems it cant handle this case where the two fields are different. You could maybe eval the old field to the new field and somehow get a multivalued field then that has both values, but im not sure what to do then...
But It looks like the
autoregress command might give you a different way:
<your search> | autoregress heapAfterGC AS previousHeapAfterGC p=1 | eval delta=heapAfterGC-previousHeapAfterGC
Autoregress was created primarily to give you moving averages (with p>1), but it seems to work fine with p=1 too.