# Create dynamic column and save output in ES

**URL:** <https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007>\
**Category:** Logstash\
**Created:** [July 20, 2016, 5:19pm UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007 "2016-07-20T17:19:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [July 20, 2016, 5:19pm UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007/1 "2016-07-20T17:19:46Z")

</div>

Here is my question. I have following column which has Int type.

1. DurationA
2. DurationB
3. Duration C = DurationB-DurationA

DurationA and DurationB values comes from Different CSV file which I am loading to ES through Logstash

Question

1. is there anyway I can create column DurationC and save value in ES while I am processing CSV file ?
2. if not possible what function I should use in ES Query to get the desired result (DurationB-DurationA)

Thanks

---

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [July 21, 2016, 3:42pm UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007/2 "2016-07-21T15:42:49Z")

</div>

can anyone help me on this issue ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 29, 2016, 10:26am UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007/3 "2016-07-29T10:26:47Z")

</div>

1. You might be able to use an aggregate filter, but I suspect it'll be fragile. Logstash isn't meant for the kind of join scenario that you describe.
2. ES doesn't do joins either, so unless you have DurationA and DurationB in the same document you're out of luck.

I suspect you'll need some custom glue for this. Logstash can help you read the CSV files but you either need a custom plugin or a custom something else for the join operation. I can't get more specific without more details.

---

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [August 1, 2016, 8:50pm UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007/4 "2016-08-01T20:50:24Z")

</div>

Thanks magnusbaeck for your reply. DurationA and DurationB values is there in same document. Once documents loaded in ES , can I update my ES document to populate DurationC ? if yes what aggregate function I can use it ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007/5 "2017-07-06T04:45:29Z")

</div>

Closed on July 6, 2017, 4:45am UTC