# Calculate time between different events with same ID

**URL:** https://discuss.elastic.co/t/calculate-time-between-different-events-with-same-id/230900
**Category:** Logstash
**Created:** [May 3, 2020, 9:47pm UTC](https://discuss.elastic.co/t/calculate-time-between-different-events-with-same-id/230900 "2020-05-03T21:47:24Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![John\_Guzman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_guzman/32/83587_2.png) [@John\_Guzman](https://discuss.elastic.co/u/John_Guzman)
#### Post date: [May 3, 2020, 9:47pm UTC](https://discuss.elastic.co/t/calculate-time-between-different-events-with-same-id/230900/1 "2020-05-03T21:47:24Z")

</div>

Hi!

I been struggling with this some few months and i haven't found a good way to do it. I'm passing events to logstash correspondent to transactions, each transaction is composed of n events and i have to calculate the time between each event of that transaction. Multiple events of differents transactions can appear the same time. At this moment i had to create my own filter plugin to do it, and i'm calculating the time well, but the problem is that i don't have any way to determinate which event is the last one in order to delete it from memory and adding an 'end' and 'start' field it's impossible to me due to other business stuff. Also, im not expert on Ruby so this has been some difficult to me to made.

So, my question is: Is there a way to make this of a easier way? I arealdy tried the elapsed and aggregate filter, but didnt found a way to make it work as i need.

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2020, 9:47pm UTC](https://discuss.elastic.co/t/calculate-time-between-different-events-with-same-id/230900/2 "2020-05-31T21:47:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
