Compare fields in two documents?

Scripted fields can only calculate data WITHIN one document. You CANNOT calculate data across multiple documents.

To achieve writing that diff, you will need to measure it before indexing the documents, so that you write the time diff to the ending document.

In Logstash e.g. the elapsed plugin can achieve that.

Cheers,
Tim

2 Likes