# Adding duration field from start date and end date **URL:** \ **Category:** Logstash\ **Created:** [June 4, 2016, 3:42pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857 "2016-06-04T15:42:03Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\ **Post date:** [June 4, 2016, 3:42pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/1 "2016-06-04T15:42:03Z")
Hi. I am struggling to get the duration for a start and end date in a log entry. I have the following fields: TIME=2016/05/29 13:23:04.286 TIME\_END=2016/05/29 13:23:04.493 I would like to get the duration between the two fields, I have tried the following however it is not working: mutate { add\_field =\> { elapsed =\> "%{TIME}-%{TIME\_END}" } } and this code, however also did not work: ruby { code =\> "event['duration'] = (event['TIME']) - map['TIME\_END']" } Any suggestions on how to get the duration between the two fields would be appreciated. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 8, 2016, 6:18pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/2 "2016-06-08T18:18:04Z")
Use a ruby filter to convert those two fields to a timestamp value where date arithmetic works, then perform the subtraction. Something like ```auto ruby { init => "require 'date'" code => " event['duration'] = 86400 * ( DateTime.strptime(event['TIME_END'], '%Y/%m/%d %H:%M:%S.%L') - DateTime.strptime(event['TIME'], '%Y/%m/%d %H:%M:%S.%L')) " } ``` should work to get the duration in seconds. ---
**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\ **Post date:** [June 8, 2016, 7:19pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/3 "2016-06-08T19:19:49Z")
Thank you very much for the response and the ruby script. I however can see currently different results: 203/1000 41/200 207/1000 51/250 211/1000 etc. What do these results in the duration field exactly mean? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 9, 2016, 8:03pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/4 "2016-06-09T20:03:32Z")
What, exactly, does your code look like? ---
**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\ **Post date:** [June 9, 2016, 8:39pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/5 "2016-06-09T20:39:46Z")
Here is my code that I am using: input { file { type =\> "probe" path =\> ["/Syslogs/\_files/\*.TXT"] start\_position =\> beginning sincedb\_path =\> "/Syslogs/db/probe" ignore\_older =\> 864000000000 } } filter { grok { match =\> ["message", "%{GREEDYDATA:kv}"] } kv { source =\> "kv" field\_split =\> ";" value\_split =\> "=" remove\_field =\> "kv" } ruby { init =\> "require 'date'" code =\> " event['duration'] = 86400 \* ( DateTime.strptime(event['TIME\_END'], '%Y/%m/%d %H:%M:%S.%L') - DateTime.strptime(event['TIME'], '%Y/%m/%d %H:%M:%S.%L')) " } date { locale =\> "en" match =\> ["TIME", "yyyy/MM/dd HH:mm:ss.SSS", "ISO8601"] timezone =\> "Africa/Windhoek" target =\> "@timestamp" add\_field =\> { "debug" =\> "timestampMatched"} } } output { elasticsearch { hosts =\> "localhost:9200" } ---
**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\ **Post date:** [July 22, 2016, 2:50pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/6 "2016-07-22T14:50:58Z")
Just wanted to find out if anyone can help with this? ---
**Author:** ![yahoo](https://avatars.discourse-cdn.com/v4/letter/y/898d66/32.png) [@yahoo](https://discuss.elastic.co/u/yahoo)\ **Post date:** [August 14, 2016, 5:12pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/7 "2016-08-14T17:12:22Z")
Hi @Hans and @magnusbaeck in my log I have action start time and action end time formatted as HHmmss. I used the following code in my logstash filter. It works well if the action lasts during the same day. However, I run into problems when the action end time passes midnight. For example: this action's duration is 5 minutes action start time 23:58:00 action end time 00:03:00 the next day Then I get a wrong calculation (negative value). I appreciate any help in solving this problem. ``` # get the duration of the action_time date { match => ["[action_start_time]", "HHmmss"] target => "[action_start_timed]" timezone => "America/New_York" } date { match => ["[action_end_time]", "HHmmss"] target => "[action_end_timed]" timezone => "America/New_York" } ruby { code => "event['action_duration'] = (event['action_end_timed'] - event['action_start_timed'])" } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 14, 2016, 6:32pm UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/8 "2016-08-14T18:32:50Z")
@yahoo, please start your own thread. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/adding-duration-field-from-start-date-and-end-date/51857/9 "2017-07-06T04:43:33Z")