# Calculation time difference between two document

**URL:** <https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876>\
**Category:** Kibana\
**Created:** [April 1, 2019, 9:12pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876 "2019-04-01T21:12:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradyumna\_Jha](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@Pradyumna\_Jha](https://discuss.elastic.co/u/Pradyumna_Jha)\
**Post date:** [April 1, 2019, 9:12pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/1 "2019-04-01T21:12:17Z")

</div>

I am collecting log data and putting it into elastic search. Each document has 4 columns containing timestamp, key(not unique), Interface and Message. I need to calculate the time difference between two rows with same value in key column for a particular interface column value containing specific message. Is there a way i can do this and visualize in Kibana. Finally i want a visualization which shows the calculated time difference at one axis and unique set to keys to another. Please help me out here.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 1, 2019, 9:15pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/2 "2019-04-01T21:15:29Z")

</div>

There are a number of threads on this from others asking the same thing, try a search and see what works for you.

---

<div class="post-metadata">

**Author:** ![Pradyumna\_Jha](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@Pradyumna\_Jha](https://discuss.elastic.co/u/Pradyumna_Jha)\
**Post date:** [April 1, 2019, 9:20pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/3 "2019-04-01T21:20:40Z")

</div>

If you can please suggest a link. That would be helpful. Thanks for the quick response.

---

<div class="post-metadata">

**Author:** ![Pradyumna\_Jha](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@Pradyumna\_Jha](https://discuss.elastic.co/u/Pradyumna_Jha)\
**Post date:** [April 1, 2019, 10:06pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/4 "2019-04-01T22:06:42Z")

</div>

It seems one cannot work on building logic for 2 different documents columns in Kibana rather they can use Scripted fields for logic building on different columns but for same same document . Is that right? How to perform calculations on two different documents columns?

---

<div class="post-metadata">

**Author:** ![Pradyumna\_Jha](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@Pradyumna\_Jha](https://discuss.elastic.co/u/Pradyumna_Jha)\
**Post date:** [April 1, 2019, 11:01pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/5 "2019-04-01T23:01:00Z")

</div>

This seems to be the only solution.

> [@Compare fields in two documents?](https://discuss.elastic.co/t/compare-fields-in-two-documents/116548/2):
>
> Scripted fields can only calculate data WITHIN one document. You CANNOT calculate data across multiple documents. To achieve writing that diff, you will need to measure it before indexing the documents, so that you write the time diff to the ending document. In Logstash e.g. the [elapsed](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html) plugin can achieve that. Cheers, Tim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 11:15pm UTC](https://discuss.elastic.co/t/calculation-time-difference-between-two-document/174876/6 "2019-04-29T23:15:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
