# Elapsed questions

**URL:** <https://discuss.elastic.co/t/elapsed-questions/102708>\
**Category:** Logstash\
**Created:** [October 4, 2017, 1:07pm UTC](https://discuss.elastic.co/t/elapsed-questions/102708 "2017-10-04T13:07:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kiwi0217](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@kiwi0217](https://discuss.elastic.co/u/kiwi0217)\
**Post date:** [October 4, 2017, 1:07pm UTC](https://discuss.elastic.co/t/elapsed-questions/102708/1 "2017-10-04T13:07:56Z")

</div>

i can count the elapsed time. but in kibana it just display the time count. i want to count time with difference user  
the log is:  
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: test|  
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: test|  
|2017-09-29-15:13:57|INFO|JupyterHub|User logged in: jupyter|  
|2017-09-29-15:14:21|INFO|JupyterHub|User logged out: jupyter|

the filter is:  
grok {  
patterns\_dir =\> ["/etc/logstash/conf.d/pattern"]  
match =\> {  
"loginout" =\> "User logged in: %{JUSER:jupyter\_user}"  
}  
add\_tag =\> ["taskStarted"]  
tag\_on\_failure =\> []  
}  
grok {  
patterns\_dir =\> ["/etc/logstash/conf.d/pattern"]  
match =\> {  
"loginout" =\> "User logged out: %{JUSER:jupyter\_user}"  
}  
add\_tag =\> ["taskEnded"]  
tag\_on\_failure =\> []  
}  
elapsed {  
start\_tag =\> "taskStarted"  
end\_tag =\> "taskEnded"  
unique\_id\_field =\> "jupyter\_user"  
timeout =\> 1800  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/elapsed-questions/102708/2 "2017-10-06T05:33:46Z")

</div>

> [@kiwi0217](#):
>
> but in kibana it just display the time count

What do you mean?

> [@kiwi0217](#):
>
> patterns\_dir =\> ["/etc/logstash/conf.d/pattern"]

You should really move this pattern file elsewhere. That's the directory Logstash assumes config files are, not pattern ones.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2017, 5:34am UTC](https://discuss.elastic.co/t/elapsed-questions/102708/3 "2017-11-03T05:34:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.