Calculating time diff between @timestamp and document date field

Elastic Stack Elasticsearch
1

HI,
I'm having trouble calculating time diff (in seconds) between @timestamp and 'eventTime' date field using script field inside search query.
My mappings for 'eventTime' field is:

  "mapping": {
    "dynamic": "false",
    "properties": {
      "eventTime": {
        "type": "date"
      }
    }
  }

and script field inside search query looks like this:

  "script_fields": {
    "time_diff1": {
      "script": {
        "lang": "painless",
        "source": "(doc['@timestamp'].value.toInstant().toEpochMilli() - doc.eventTime.value.toInstant().toEpochMilli()) / 1000"
      }
    }

But I'm getting an error: "No field found for [@timestamp] in mapping with types "

        "(doc['@timestamp'].value.toInstant().toEpochMilli() - doc.eventTime.value.toInstant().toEpochMilli()) / 1000",
        "     ^---- HERE"

My question is how to get this scripted field to work? Either by using painless or expression language. I've tried various approaches but with no luck.
Thanks in advance.

2

Do you have a field in your mappings called @timestamp? The error indicates there is no mapping for that field. One thing to consider is which indexes your query is on. Given your script, all indexes you are querying would need to have both @timestamp and eventTime mapped.

3

HI,
You are right, I don't have mapping for @timestamp field. It's special field introduced by Logstash but I would like to have access to its value if possible.
I can see this field and it's value when in Kibana expanding the _source booth in JSON or Table tab:
1

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.