# Divide two fields and store in a new field to be visualized in Kibana

**URL:** https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400
**Category:** Logstash
**Created:** [November 28, 2016, 9:17pm UTC](https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400 "2016-11-28T21:17:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Mike\_Clarke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_clarke/32/87948_2.png) [@Mike\_Clarke](https://discuss.elastic.co/u/Mike_Clarke)
#### Post date: [November 28, 2016, 9:17pm UTC](https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400/1 "2016-11-28T21:17:17Z")

</div>

I would like to take two fields from a GROK filter and divide the two to get the number of events occurring in one second.  
ES, LS, FB, Kibana all 5.0.

Something like this time\_per\_sel = enrichtime / totalsel.

Input:  
`2016-14-12 14:45:33,655 [sdfsdfd] DEBUG were.were.werwer - Total TEST Enrichment Time: 12591 for 1 total selectors /teset/setset/setst/setwetghdfgh 200`

GROK Filter:

```auto
grok {
  match => { "message" => ".*Enrichment Time: %{INT:enrichtime:int} for %{INT:totalsel:int} "}
}

```

I believe that I need to use Ruby code to do this since it currently isn't available in the ELK stack natively.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 29, 2016, 9:21pm UTC](https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400/2 "2016-11-29T21:21:18Z")

</div>

Yes, you need a ruby filter for this.

```nohighlight
ruby {
  code => "event.set('time_per_sel', event.get('enrichtime') / event.get('totalsel'))"
}

```

---

<div class="post-metadata">

### Author: ![Mike\_Clarke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_clarke/32/87948_2.png) [@Mike\_Clarke](https://discuss.elastic.co/u/Mike_Clarke)
#### Post date: [November 30, 2016, 11:56am UTC](https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400/3 "2016-11-30T11:56:41Z")

</div>

Thanks for the help! I was close but off slightly on my event.get calls.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 28, 2016, 11:56am UTC](https://discuss.elastic.co/t/divide-two-fields-and-store-in-a-new-field-to-be-visualized-in-kibana/67400/4 "2016-12-28T11:56:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.