# Elapsed filter: where is "elapsed\_time" stored?

**URL:** <https://discuss.elastic.co/t/elapsed-filter-where-is-elapsed-time-stored/111497>\
**Category:** Logstash\
**Created:** [December 13, 2017, 7:17am UTC](https://discuss.elastic.co/t/elapsed-filter-where-is-elapsed-time-stored/111497 "2017-12-13T07:17:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ganesh\_Venkataraman](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@Ganesh\_Venkataraman](https://discuss.elastic.co/u/Ganesh_Venkataraman)\
**Post date:** [December 13, 2017, 7:17am UTC](https://discuss.elastic.co/t/elapsed-filter-where-is-elapsed-time-stored/111497/1 "2017-12-13T07:17:18Z")

</div>

I have written elapsed filter and putting logstash in debug I am able to see it calculates correctly. How do i store it to a new field or does it get automatically stored somewhere?

add\_field line in my code does not work. Have tried multiple options.

```
elapsed {
    unique_id_field => "msg_id"
    start_tag => "tds_start"
    end_tag => "tds_end"
    new_event_on_match => true
    timeout => 600
    add_field => {"tds_latency" => "%{[elapsed_time]}"} 

```

}

[2017-12-13T06:44:05,388][DEBUG][logstash.pipeline] output received {"event"=\>{"@timestamp"=\>2017-12-13T06:44:05.356Z, "@version"=\>"1", "host"=\>"sabre-rhel6.localdomain", "elapsed\_time"=\>[20.001], "msg\_id"=\>"ID:11561009-21-54584-163010", "tags"=\>["elapsed", "elapsed\_match"], "elapsed\_timestamp\_start"=\>2017-12-13T06:43:43.134Z}}

---

<div class="post-metadata">

**Author:** ![Ganesh\_Venkataraman](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@Ganesh\_Venkataraman](https://discuss.elastic.co/u/Ganesh_Venkataraman)\
**Post date:** [December 13, 2017, 7:23am UTC](https://discuss.elastic.co/t/elapsed-filter-where-is-elapsed-time-stored/111497/2 "2017-12-13T07:23:21Z")

</div>

Ignore. It was due to "new\_event\_on\_match =\> true".

I turned it off and a new field got elapsed\_time got created automatically!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2018, 7:23am UTC](https://discuss.elastic.co/t/elapsed-filter-where-is-elapsed-time-stored/111497/3 "2018-01-10T07:23:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.