# Add a time field in elasticsearch and calculate time between two event

**URL:** https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971
**Category:** Logstash
**Tags:** docker
**Created:** [May 30, 2022, 3:22pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971 "2022-05-30T15:22:07Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)
#### Post date: [May 30, 2022, 3:22pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971/1 "2022-05-30T15:22:07Z")

</div>

I'm new to Elasticsearch.

I’m working with log files stored in Elasticsearch, that contains information about some operations on differents levels, I have a field timestamp that represents the time when each operation has occured on each step.

This is my work flow:

> -folder-\> filebeat -\> logstash -\> elasticsearch \<- kibana

I want to calculate the time between the start and the end of the process. between **step1** and **step 3** and add it to a field that I will create so I can visualize it on Kibana.

This is an exemple of some of my logs.

`{“log_level”:“INFO”,“timestamp”:“2021-12-22T11:49:06.124890Z”,“event_type”:“step1”,“mid”:“96712abc”}{“log_level”:“INFO”,“timestamp”:“2021-12-22T11:49:07.124890Z”,“event_type”:“step2”,“mid”:“96712abc”} {“log_level”:“INFO”,“timestamp”:“2021-12-22T11:49:08.124890Z”,“event_type”:“step3”,“mid”:“96712abc”}`

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 30, 2022, 4:20pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971/2 "2022-05-30T16:20:39Z")

</div>

Use an [aggregate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) filter. You may want something like example 1 or example 3 depending on whether the steps are fixed or variable.

---

<div class="post-metadata">

### Author: ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)
#### Post date: [May 31, 2022, 10:42am UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971/3 "2022-05-31T10:42:33Z")

</div>

Thank your for your reply, In the first exemple:

match =\> [ "message", "%{LOGLEVEL:loglevel} - %{NOTSPACE:taskid} - %{NOTSPACE:logger} - %{WORD:label}( - %{INT:duration:int})?"

What is the role of the question mark ?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 31, 2022, 2:48pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971/4 "2022-05-31T14:48:57Z")

</div>

> [@The-morpho](#):
>
> What is the role of the question mark ?

? means "zero or more", so the `( - %{INT:duration:int})` part is optional. It occurs on the SQL lines, but not the start and end.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 28, 2022, 2:49pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971/5 "2022-06-28T14:49:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.