# Best way to get information of proccessing flow

**URL:** <https://discuss.elastic.co/t/best-way-to-get-information-of-proccessing-flow/52594>\
**Category:** Kibana\
**Created:** [June 13, 2016, 10:29am UTC](https://discuss.elastic.co/t/best-way-to-get-information-of-proccessing-flow/52594 "2016-06-13T10:29:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [June 13, 2016, 10:29am UTC](https://discuss.elastic.co/t/best-way-to-get-information-of-proccessing-flow/52594/1 "2016-06-13T10:29:16Z")

</div>

Hi,

we have a logfile which holds following essential information:

> timestamp, order\_id, status\_id

the order\_id is identifying an order, which goes through different status during it's life.

Now I want to gather the information how long the order is inside which status.

What is the best way to hit this target? We are currently on following versions: Elasticsearch 1.6.0, Logstash 1.5.1, Kibana 3.1.1.

Idea 1: querying elasticsearch from logstash while processing the logmessage, requesting timestamp of previous status.

- is that possible? How?

Idea 2: Somehow to aggregate in post processing in kibana / elasticsearch

- how?

Idea 3: please tell me.

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 13, 2016, 10:48am UTC](https://discuss.elastic.co/t/best-way-to-get-information-of-proccessing-flow/52594/2 "2016-06-13T10:48:24Z")

</div>

I suspect the best way to do this might be through the creation of an [entity-centric index](https://www.elastic.co/elasticon/2015/sf/building-entity-centric-indexes). This will hold a document per order, which will be updated for each new entry, e.g. through a [scripted update](https://www.elastic.co/guide/en/elasticsearch/reference/1.6/docs-update.html#_scripted_updates). I think recent versions of Logstash have support for scripted updates, so doing it through Logstash would require an upgrade, but it can also be done through an external script.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:50pm UTC](https://discuss.elastic.co/t/best-way-to-get-information-of-proccessing-flow/52594/3 "2017-07-06T13:50:42Z")

</div>