Compare 2 lines of a given index

Elastic Stack Kibana
1

Hi !

My system is giving me two lines Start/Stop in the same index for the use of services. It looks like the following example :
Timestamp1 Start Service1 IDService11
Timestamp2 Start Service1 IDService21
Timestamp3 Stop Service1 IDService21
Timestamp4 Stop Service1 IDService11

I want here to calculate the duration of each IDServices. So I would like to have :
Duration1 : Timestamp4 - Timestamp1
Duration2 : Timestamp3 - Timestamp2

Then, I will have to add all the Duration to know for how long each of my services are used :
TotalDuration = Duration1 + Duration2
The objective is to display a bar chart with the TotalDuration of each Services.

I don't find how to isolate a specific IDService and make the difference between Start and Stop.
I found a lot of topic regarding the comparison of 2 fields from 2 different indexes but nothing on the same field on the same index but for two lines.
Do you have any idea on how to make this ?

2

Hello,

You can use either runtime fields or scripted fields to add a field which does it and use it in your analytics.

Thanks
Bhavya

1 Like
3

Might be useful for you later,
If you are using logstash this is a good example for Aggregate filter

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.