# Create a field based on the values from future log **URL:** \ **Category:** Elasticsearch\ **Created:** [May 25, 2020, 7:25am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093 "2020-05-25T07:25:17Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 25, 2020, 7:25am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/1 "2020-05-25T07:25:17Z")
My use case is like this: I have to create a data table from an index. The value of one of the column of the table is based on the data from another field of the same index in the next 5 seconds. Is it possible to do so? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 12:47am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/2 "2020-05-26T00:47:21Z")
Yes it is. ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 1:00am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/3 "2020-05-26T01:00:42Z")
How to accomplish that? Scripted field or or other thing? Would u provide some link or examples ? 「Mark Walkom via Discuss the Elastic Stack \<[elastic@discoursemail.com](mailto:elastic@discoursemail.com)\>」在 2020年5月26日 週二，上午8:57 寫道： ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 1:03am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/4 "2020-05-26T01:03:56Z")
Do you want to create this in the same index, or another one? ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 1:15am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/5 "2020-05-26T01:15:25Z")
In the same index 「Mark Walkom via Discuss the Elastic Stack \<[elastic@discoursemail.com](mailto:elastic@discoursemail.com)\>」在 2020年5月26日 週二，上午9:14 寫道： ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 1:20am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/6 "2020-05-26T01:20:23Z")
To be clear you want to go back in time and add this data to older events, based on the events in the immediate 5 seconds after it? eg if you have an event at 2020-01-01 12:00:00, then calculate the value of the field in that event based on the metrics from events up to 2020-01-01 12:00:05? ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 1:30am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/7 "2020-05-26T01:30:54Z")
yes.... The use case is something like this let say there are two fields, one is called 'no' and the other is called 'recovered in 5 s' I don't want the value of the field 'no' more than 10, and if it is I want to check if it has resumed(lower than 10) in next 5 s. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 1:32am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/8 "2020-05-26T01:32:39Z")
Ok. I believe that's something you could do with Alerting, but it's outside my experience sorry. ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 1:35am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/9 "2020-05-26T01:35:25Z")
Thank you for your input. Let me have a look at alerting ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 1:42am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/10 "2020-05-26T01:42:00Z")
One more thing....I don't need to send alert, i just need the field 'resumed in 5 s' showing if the value of 'no' is lower than 10 in 5 s. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 1:45am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/11 "2020-05-26T01:45:14Z")
Alerting can index back into Elasticsearch though, see [https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-index.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-index.html). You might be able to use that to identify the documents and then update them. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 26, 2020, 5:27am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/12 "2020-05-26T05:27:58Z")
How do you link the events that are related? Is there a unique id of some kind? ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 5:58am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/13 "2020-05-26T05:58:44Z")
no.......the situation is like this: Let say we are collecting the temperature of different countries. So There are two items in the log: location and temperature. The temperature is measured every second and logged. I import this log into ELK. Now i want to find out if the temperature of a countries is too high and if it is, is it drop back to certain temperature in next 5 seconds. I want to indicate this kind of change in an extra field in ELK. For example: the extra field is called "tooHot" , if the temperature is more than 25, put yes in the "tooHot" Field. If the temperature drop below 25 in next 5 s , put 'recovered' in the field of 'tooHot'. Is it possible to accomplish this in ELK? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 6:16am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/14 "2020-05-26T06:16:24Z")
Why not do that at ingest time and look at the last 5 seconds to figure out what the value should be? ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 6:21am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/15 "2020-05-26T06:21:38Z")
i am using filebeat to collect data. Are you saying i can do that in filebeat? and i need to access the value from the next 5 s ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2020, 6:34am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/16 "2020-05-26T06:34:54Z")
It's not entirely clear why you need to go back and update events? Why not just use the latest event as the current status, and set that status based on the past events? ---
**Author:** ![iammanmale](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Post date:** [May 26, 2020, 6:49am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/17 "2020-05-26T06:49:51Z")
...i think it is different. What I want to do is that when I look at a record showing the temperature is too high, I want to know if it has already dropped to normal. That is something not yet happen at the moment of that record is generated. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 23, 2020, 6:50am UTC](https://discuss.elastic.co/t/create-a-field-based-on-the-values-from-future-log/234093/18 "2020-06-23T06:50:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.