# Compare 2 lines of a given index

**URL:** <https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253>\
**Category:** Kibana\
**Created:** [May 18, 2021, 8:47am UTC](https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253 "2021-05-18T08:47:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ronan\_Petit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ronan_petit/32/88876_2.png) [@Ronan\_Petit](https://discuss.elastic.co/u/Ronan_Petit)\
**Post date:** [May 18, 2021, 8:47am UTC](https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253/1 "2021-05-18T08:47:34Z")

</div>

Hi !

My system is giving me two lines Start/Stop in the same index for the use of services. It looks like the following example :  
Timestamp1 Start Service1 IDService11  
Timestamp2 Start Service1 IDService21  
Timestamp3 Stop Service1 IDService21  
Timestamp4 Stop Service1 IDService11

I want here to calculate the duration of each IDServices. So I would like to have :  
Duration1 : Timestamp4 - Timestamp1  
Duration2 : Timestamp3 - Timestamp2

Then, I will have to add all the Duration to know for how long each of my services are used :  
TotalDuration = Duration1 + Duration2  
The objective is to display a bar chart with the TotalDuration of each Services.

I don't find how to isolate a specific IDService and make the difference between Start and Stop.  
I found a lot of topic regarding the comparison of 2 fields from 2 different indexes but nothing on the same field on the same index but for two lines.  
Do you have any idea on how to make this ?

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [May 20, 2021, 9:34pm UTC](https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253/2 "2021-05-20T21:34:16Z")

</div>

Hello,

You can use either runtime fields or scripted fields to add a field which does it and use it in your analytics.

> **[Introducing Elasticsearch runtime fields](https://www.elastic.co/blog/introducing-elasticsearch-runtime-fields)**
>
> In 7.11, we’re excited to announce schema on read in the Elastic Stack. We now offer the best of both worlds on a single platform. Schema on read for performance and schema on write for flexibility. We call our implementation runtime fields.

> **[Scripted fields | Kibana Guide \[7.12\] | Elastic](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)**

Thanks  
Bhavya

---

<div class="post-metadata">

**Author:** ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)\
**Post date:** [May 25, 2021, 3:53am UTC](https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253/3 "2021-05-25T03:53:30Z")

</div>

Might be useful for you later,  
If you are using logstash this is a good example for [Aggregate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) filter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2021, 3:53am UTC](https://discuss.elastic.co/t/compare-2-lines-of-a-given-index/273253/4 "2021-06-22T03:53:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.