Compare fields and report

[pclokcer (Erdem)]

example data

{
 "timestamp": "2023-01-04T14:00:00.00Z",
 "url": "http://localhost/test",
 "trace_id": "asdasdasd"
}

{
 "timestamp": "2023-01-04T14:01:00.000Z",
 "url": "http://localhost/test",
 "trace_id": "asdasdasd"
}

I want to compare two data and see to table like this

url                    |     trace_id     |  response time
------------------------------------------------------------------------------------------------
http://localhost/test  |     asdasdasd    |    60 second

How can I report like this ?

[nickpeihl]

Hi Erdam,

I presume http://localhost/test might have more than two entries in your logs. Are you only looking to get the response time from the latest two entries?

[pclokcer (Erdem)]

Hi,

I want to take first and last entry. because I need to see response time.

[nickpeihl]

HI Erdem.

There is currently no out-of-the-box way to do this in Kibana or Elasticsearch. There is a history of discussions on this, especially in this thread.

I would recommend finding a way to calculate the elapsed time at ingest. The Logstash Elapsed filter plugin is a good example of this.

[pclokcer (Erdem)]

Hi,

thank you for interest me