# Calculate Date difference in LOGSTASH based on conditional text

**URL:** <https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759>\
**Category:** Logstash\
**Created:** [May 23, 2017, 5:37am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759 "2017-05-23T05:37:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [May 23, 2017, 5:37am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/1 "2017-05-23T05:37:53Z")

</div>

I have a condition here: I have a series of logs where it starts from startTransaction and ends at endtransaction. Now between there two events there are other logs.

My requirement is to capture the log time for the above mentioned events and calculate the difference.

As i read logstash do not support loop, there will be multiple blocks of start and end events, where I need to calculate the time difference.

Please help with some approach.

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 23, 2017, 11:31am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/2 "2017-05-23T11:31:53Z")

</div>

What about elapsed plugin?  
[https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-elapsed.html](https://www.elastic.co/guide/en/logstash/5.4/plugins-filters-elapsed.html)

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [May 24, 2017, 2:45am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/3 "2017-05-24T02:45:54Z")

</div>

How to add the calculated field ?

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [May 24, 2017, 3:01am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/4 "2017-05-24T03:01:15Z")

</div>

elapsed {  
start\_tag =\> "eventstart"  
end\_tag =\> "eventend"  
unique\_id\_field =\> "event\_duration"  
timeout =\> 600  
new\_event\_on\_match =\> false  
add\_field =\> { "event\_duration" =\> "%{elapsed\_duration}" }  
}

This is not adding any field

---

<div class="post-metadata">

**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\
**Post date:** [May 24, 2017, 3:05am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/5 "2017-05-24T03:05:11Z")

</div>

Could use a ruby code... Its simples abd flexible.

---

<div class="post-metadata">

**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Post date:** [May 24, 2017, 3:47am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/6 "2017-05-24T03:47:04Z")

</div>

Can you give me some sample, i have never used ruby

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2017, 3:54am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759/7 "2017-06-21T03:54:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.