# Creating new scripted field to showing time difference between 2 log lines

**URL:** <https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112>\
**Category:** Kibana\
**Created:** [October 23, 2020, 9:49am UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112 "2020-10-23T09:49:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![singyim817](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@singyim817](https://discuss.elastic.co/u/singyim817)\
**Post date:** [October 23, 2020, 9:49am UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112/1 "2020-10-23T09:49:53Z")

</div>

Hi there,

I got a similar situation like this.

> [@How to calculate time difference between two events in postprocessing?](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023):
>
> Hi there, I have logs which contain a log line for starting and finishing a process. it looks like this: . I need the time difference between the "tux state retrieved" and "tux state retrieved". Since the data is already indexed, I would like to know, if there is an option to calculate this in kibana or timelion as postprocessing. I am aware that there are possibilities of calculating it on index times in logstash. I will check this in future. Thanks, Andreas

I have assigned a unique ID for each pair of lines, then I need to calculate the transaction time in second between the datetime value in these lines, finally display on line chart to show average transaction time by date time.

Is there any possible way without modifying logstash config?

Thank you very much 🙂

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [October 26, 2020, 2:51pm UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112/2 "2020-10-26T14:51:32Z")

</div>

Elasticsearch and Kibana generally expect you to work with a single document at a time, but there are some options you can use:

1. Without changing your logstash pipeline, you could try using the [transformations feature](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) of Elasticsearch, because you said that each pair of lines has a unique id. You could set up the pipeline this way:

- Group by unique ID
- Get the minimum timestamp and maximum timestamp and assign them to a single field
- I think you can even calculate the max - min timestamp using a painless script in the transformations

This would let you visualize the duration using Kibana.

1. Another option might be to [use Vega](https://www.elastic.co/guide/en/kibana/current/vega-graph.html) to construct a query where you group by the unique IDs, and do the same calculation that I previously described. This is probably harder than the previous option.

---

<div class="post-metadata">

**Author:** ![singyim817](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@singyim817](https://discuss.elastic.co/u/singyim817)\
**Post date:** [October 30, 2020, 9:38am UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112/3 "2020-10-30T09:38:02Z")

</div>

Thanks for your answering @wylie .

For first solution, I can't find transformations feature from my Kibana.

May I make sure the above solutions are supported with my Kibana?

My Kibana version is 6.2.3

Thank you.

---

<div class="post-metadata">

**Author:** ![wylie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wylie/32/81794_2.png) [@wylie](https://discuss.elastic.co/u/wylie)\
**Post date:** [October 30, 2020, 2:28pm UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112/4 "2020-10-30T14:28:49Z")

</div>

Transforms were introduced in 7.2, and have been significantly improved in later versions. 7.9 is the most recent version of the stack that has been released.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2020, 2:28pm UTC](https://discuss.elastic.co/t/creating-new-scripted-field-to-showing-time-difference-between-2-log-lines/253112/5 "2020-11-27T14:28:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.