# Calculated fields

**URL:** <https://discuss.elastic.co/t/calculated-fields/231773>\
**Category:** Kibana\
**Created:** [May 8, 2020, 4:29pm UTC](https://discuss.elastic.co/t/calculated-fields/231773 "2020-05-08T16:29:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![derekmizak](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@derekmizak](https://discuss.elastic.co/u/derekmizak)\
**Post date:** [May 8, 2020, 4:29pm UTC](https://discuss.elastic.co/t/calculated-fields/231773/1 "2020-05-08T16:29:40Z")

</div>

Hi,

I have a log which looks more less like this:

```
23/03/2020 8:15, mary, pc1154, SessionStarted, SessionID 1, Tools3
23/03/2020 9:00, john, pc2345, SessionStarted, SessionID 2, Apps1
23/03/2020 9:10, SessionID 1, SessionTerminated
23/03/2020 9:30, SessionID 2, SessionTerminated

```

I want to produce a report which would show duration of each session in the following form:

```
username, ClientMachineName, DeliveryGroup, SessionStartTime, SessionEndTime, SessionDuration
john, pc2345, Apps1, 23/03/2020 9:00, 23/03/2020 9:10, 0:10
mary, pc1154, Tools3, 23/03/2020 8:15, 23/03/2020 9:30 1:15

```

I can use python to manipulate it outside Elastic, produce new document like in the second log and and index it back in.  
However, Do you know if there is any solution to do such a transformation natively in Elastic/Kibana?

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [May 8, 2020, 4:41pm UTC](https://discuss.elastic.co/t/calculated-fields/231773/2 "2020-05-08T16:41:01Z")

</div>

Hi @derekmizak, have you checked [Transformations](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html)? This mechanism is exactly meant to produce derivative indexes that pivot your datasets to produce updated metrics.

---

<div class="post-metadata">

**Author:** ![derekmizak](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@derekmizak](https://discuss.elastic.co/u/derekmizak)\
**Post date:** [May 8, 2020, 7:18pm UTC](https://discuss.elastic.co/t/calculated-fields/231773/3 "2020-05-08T19:18:08Z")

</div>

Hi, @jsanz - thank you a lot - it is exactly what I was looking for. Once I am bit wiz in Transforms I will post some here as a sample. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2020, 7:18pm UTC](https://discuss.elastic.co/t/calculated-fields/231773/4 "2020-06-05T19:18:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.