# Calculate the difference of two entries **URL:** \ **Category:** Kibana\ **Created:** [August 5, 2019, 3:47pm UTC](https://discuss.elastic.co/t/calculate-the-difference-of-two-entries/193840 "2019-08-05T15:47:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![bruecp](https://avatars.discourse-cdn.com/v4/letter/b/db5fbb/32.png) [@bruecp](https://discuss.elastic.co/u/bruecp)\ **Post date:** [August 5, 2019, 3:47pm UTC](https://discuss.elastic.co/t/calculate-the-difference-of-two-entries/193840/1 "2019-08-05T15:47:35Z")
Hi, for each user we log a message to Elastic when an application starts and stops. With one application we have currently troubles, as at some users, the application crashes. Therefore, I need a simple way to subtract the app-starts from the app-stops and group this by the user. If the number is grather than 1 (as it might be that the app is currently running and not yet stopped) we have an hit. I played around with many visualization charts as also with timelion. This was my best effort, but grouping (splitting) inside the logStarted brings wrong results and at the end a grouping seems not be possible. ".es(q=logStarted).subtract(.es(q=logEipShutdown)).if(gt, 1).abs()" Any help is welcome. ---
**Author:** ![kumar8055](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@kumar8055](https://discuss.elastic.co/u/kumar8055)\ **Post date:** [August 6, 2019, 5:40am UTC](https://discuss.elastic.co/t/calculate-the-difference-of-two-entries/193840/2 "2019-08-06T05:40:11Z")
Hi @bruecp, Have you tried with the scripted fields? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 3, 2019, 5:40am UTC](https://discuss.elastic.co/t/calculate-the-difference-of-two-entries/193840/3 "2019-09-03T05:40:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.