# Calcule elapsed time of a VPN user

**URL:** <https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199>\
**Category:** Logstash\
**Created:** [June 8, 2020, 3:21pm UTC](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199 "2020-06-08T15:21:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leonardo\_Posadas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leonardo_posadas/32/68664_2.png) [@Leonardo\_Posadas](https://discuss.elastic.co/u/Leonardo_Posadas)\
**Post date:** [June 8, 2020, 3:21pm UTC](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199/1 "2020-06-08T15:21:32Z")

</div>

Hi,  
What is the best way to calculate the duration or elapsed time of a VPN user trough the logs?. I had thought of it as a timestamp difference.  
Format Message:

## Jun 7, 2020 @ 18:11:22.165 message: pptp,ppp,info \<pptp-vpn\_xxx\>: connected type: syslog @version: 1 @timestamp: Jun 7, 2020 @ 18:11:22.165 host: xxx tags: \_jsonparsefailure \_id: LNyfkHIBeL2CFmRHqQub \_type: \_doc \_index: logstash-2020.05.29-000001 \_score:

* * *

Jun 7, 2020 @ 20:01:18.403 message:

## pptp,ppp,info \<pptp-vpn\_xxx\>: disconnected type: syslog @version: 1 @timestamp: Jun 7, 2020 @ 20:01:18.403 host: xxx tags: \_jsonparsefailure \_id: DNwEkXIBeL2CFmRHUBUr \_type: \_doc \_index: logstash-2020.05.29-000001 \_score:

Thaks!.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 8, 2020, 3:39pm UTC](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199/2 "2020-06-08T15:39:36Z")

</div>

You could use an aggregate filter. See [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) in the documentation.

Make sure you set pipeline.workers to 1 and [disable java\_execution](https://github.com/elastic/logstash/issues/10938), otherwise events get processed out of order.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2020, 3:39pm UTC](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199/3 "2020-07-06T15:39:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.