# Calculate duration with ruby code

**URL:** <https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654>\
**Category:** Logstash\
**Created:** [September 2, 2019, 7:48am UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654 "2019-09-02T07:48:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 2, 2019, 7:48am UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/1 "2019-09-02T07:48:00Z")

</div>

Hi all,  
After several attempts to work with the "elapsed" filter to calculate the duration between events, I try to do so using Ruby code.  
I can't quite figure out how I can get the time of a particular event based on its tag.  
For example, these are my events:

05-07 13:20:48.808 1222 1236 D ShutdownThread: shutdown reason is: userrequested  
05-07 10:22:28.306 657 657 I boot\_progress\_start: 9977  
05-06 13:20:48.808 1222 1236 D ShutdownThread: shutdown reason is: userrequested  
05-06 10:22:28.306 657 657 I boot\_progress\_start: 9977  
05-05 13:20:48.808 1222 1236 D ShutdownThread: shutdown reason is: userrequested  
05-05 10:22:28.306 657 657 I boot\_progress\_start: 9977

This is my code for now:  
filter  
{  
dissect {  
mapping =\> {  
"message" =\> "%{[@metadata][timestamp]} %{+[@metadata][timestamp]} %{} %{} %{loglevel} %{msg}"  
}  
}   
date{  
match =\> ["[@metadata][timestamp]", "MM-dd HH:mm:ss.SSS" ]  
}

```
#device ON
if "boot_progress_start" in [message] {
	mutate {
		add_tag => "ON_event" 
	}
}

#device OFF
else if "shutdown reason is: userrequested" in [message] {
	mutate {
		add_tag => "OFF_event" 
	}
}

```

How my code in Ruby is supposed to show if I want to calculate the time between "ON" and "OFF" events.

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 2, 2019, 12:58pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/2 "2019-09-02T12:58:41Z")

</div>

You could try

```
ruby {
    code => '
        t = event.get("tags")
        if t.include? "ON_event"
            @start = event.get("@timestamp").to_f
        elsif t.include? "OFF_event"
            if @start
                event.set("elapsed", @start - event.get("@timestamp").to_f)
                @start = nil
            end
        end
    '
}

```

This assumes ordering of events is preserved, so you have to use '--pipeline.workers 1' and (for now) '--java-execution false'

---

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 2, 2019, 1:48pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/3 "2019-09-02T13:48:41Z")

</div>

I tried to use '--pipeline.workers 1' and '--java-execution false' dor the elapsed plugin but it doesn't help for me.

About the Ruby, If I have a few "ON" and "OFF" events and I want to calculate the duration for each such transaction, what needs to be changed?  
Because it works great but it calculates the time between the first "ON" and the last "OFF".

Thank you!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 2, 2019, 1:52pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/4 "2019-09-02T13:52:05Z")

</div>

> [@Alisa\_Faingold](#):
>
> Because it works great but it calculates the time between the first "ON" and the last "OFF".

No, it calculates the elapsed time for each pair.

---

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 2, 2019, 2:35pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/5 "2019-09-02T14:35:10Z")

</div>

I added the same code (plus \3600 to get it in hours), and it is calculate for me the duration between the first "ON" and the last "OFF" (45.028 hours between 05-05 10:22 to 05-07 13:20)

 ![Annotation%202019-09-02%20173440](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28234d1eb70d8cc0b7849e9bf2427d3811862720.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 2, 2019, 2:59pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/6 "2019-09-02T14:59:09Z")

</div>

That is what I would expect if you have pipeline.java\_execution enabled. The three ON events are processed first, then the three OFF events, so only one of them gets an elapsed time added.

---

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 3, 2019, 7:07am UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/7 "2019-09-03T07:07:46Z")

</div>

That make sense!  
for some reason even when I add it to a configuration file I still don't get the wanted results, maybe you might share with me what your configuration file looks like?  
Or, alternatively, how can I run that through the cmd?

Thank you very much!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 3, 2019, 12:51pm UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/8 "2019-09-03T12:51:01Z")

</div>

Either add 'pipeline.java\_execution: false' to logstash.yml or add '--java-execution false' to the command line.

---

<div class="post-metadata">

**Author:** ![Alisa\_Faingold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisa_faingold/32/45836_2.png) [@Alisa\_Faingold](https://discuss.elastic.co/u/Alisa_Faingold)\
**Post date:** [September 4, 2019, 6:04am UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/9 "2019-09-04T06:04:56Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2019, 6:04am UTC](https://discuss.elastic.co/t/calculate-duration-with-ruby-code/197654/10 "2019-10-02T06:04:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.