Add scripted field for finding difference between two dates

Elastic Stack Kibana
1

Hi,

I want to add a scripted field to calculate the difference between two dates - start date and end date. However, the format of them is a little bit different. Here's how they look like:

proc_start_time: 04:10:26
proc_end_time: 04:10:29

I want to add another field called proc_time which will calculate the difference between these two fields.

I've gone through lucene expressions and painless docs (not very good at them).

Any help would be appreciated.

2

Are they saved as a date field in Elasticsearch? then it should be really easy:
doc['proc_end_time'].value - doc['proc_start_time'].value will give you the value in miliseconds. If you set the custom format for the field to "Duration" you will also get a nice human readable format for that field.

3

This is not working, I already tried. After adding field when I go in discover tab to see data, it says:

Courier Fetch: 5 of 179 shards failed.

Just to clarify, it is not in date field. I don't want to replace @timestamp field.

Update:

Converted to date field and still not working @Marius_Dragomir

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.