# Best way to calculate and visualize uptime of all unique instances from multiple datapoints/documents in an index

**URL:** https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797
**Category:** Kibana
**Created:** [March 23, 2017, 7:07pm UTC](https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797 "2017-03-23T19:07:50Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ikirani](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ikirani](https://discuss.elastic.co/u/ikirani)
#### Post date: [March 23, 2017, 7:07pm UTC](https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797/1 "2017-03-23T19:07:50Z")

</div>

I have a dataset with one field describing status of an instance and another field holding the timestamp when the instance entered its current status.

I need to find the length of time my instances are alive and save this information to a new index or as an entry in existing index.

For eg:  
doc1: Instance001: timestamp1: status=started.  
doc2: Instance001: timestamp2: status=ready.  
doc3: Instance002: timestamp3: status=started.  
doc4: Instance003: timestamp4: status=started.  
doc5: Instance001: timestamp5: status=failed.  
doc6: Instance002: timestamp6: status=ready.  
doc7: Instance004: timestamp7: status=started.  
doc8: Instance003: timestamp8: status=failed.  
doc9: Instance004: timestamp9: status=ready.

I need the following:

Dead Instances:  
Instance001: age=timestamp5-timestamp1.  
Instance003: age=timestamp8-timestamp4.

Live Instances:  
Instance002: age=timestamp6-timestamp3.  
Instance004: age=timestamp9-timestamp7.

What is the best possible route to achieve this if all the event data of instances is in the same Index but spread across multiple document entries?

Your timely responses are appreciated.

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [March 23, 2017, 11:05pm UTC](https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797/2 "2017-03-23T23:05:00Z")

</div>

Hi there,

You could try using [Logstash's aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html). Once a document is in ES, Logstash can't aggregate it, so you'll have to do the aggregation prior to indexing the document.

Please let me know if this helps!

Thanks,  
CJ

---

<div class="post-metadata">

### Author: ![ikirani](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ikirani](https://discuss.elastic.co/u/ikirani)
#### Post date: [March 24, 2017, 2:28am UTC](https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797/3 "2017-03-24T02:28:02Z")

</div>

Just what I needed! Thanks. 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 21, 2017, 2:28am UTC](https://discuss.elastic.co/t/best-way-to-calculate-and-visualize-uptime-of-all-unique-instances-from-multiple-datapoints-documents-in-an-index/79797/4 "2017-04-21T02:28:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.