Add scripted field for finding difference between two dates


I want to add a scripted field to calculate the difference between two dates - start date and end date. However, the format of them is a little bit different. Here's how they look like:

proc_start_time: 04:10:26
proc_end_time: 04:10:29

I want to add another field called proc_time which will calculate the difference between these two fields.

I've gone through lucene expressions and painless docs (not very good at them).

Any help would be appreciated.

Are they saved as a date field in Elasticsearch? then it should be really easy:
doc['proc_end_time'].value - doc['proc_start_time'].value will give you the value in miliseconds. If you set the custom format for the field to "Duration" you will also get a nice human readable format for that field.

This is not working, I already tried. After adding field when I go in discover tab to see data, it says:

Courier Fetch: 5 of 179 shards failed.

Just to clarify, it is not in date field. I don't want to replace @timestamp field.


Converted to date field and still not working @Marius_Dragomir

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.