# Elapsed Time Filter for calculating session Duration (elapsed\_time is very big)

**URL:** <https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882>\
**Category:** Logstash\
**Created:** [October 23, 2015, 7:33pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882 "2015-10-23T19:33:56Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [October 23, 2015, 7:33pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/1 "2015-10-23T19:33:56Z")

</div>

Hello folks,

I am using Elapsed Filter Plugin for calculating the time between start\_session and session\_timeout events in my logs.

Here are some events with Timestamps

> [27/Apr/2015:10:41:45 -0500] 1 ENG NORMAL TOUCH START\_SESSION  
> [27/Apr/2015:10:41:45 -0500] 1 ENG NORMAL TOUCH DISPLAY\_LANGUAGE\_SELECT  
> [27/Apr/2015:10:43:50 -0500] 1 ENG NORMAL TOUCH SESSION\_TIMEOUT

Now my elapsed filter configuration looks something like this

> if [event] == "START\_SESSION" {  
> mutate { add\_tag =\> ["taskStarted"] }  
> } else if [event] == "SESSION\_TIMEOUT" {  
> mutate { add\_tag =\> ["taskTerminated"] }  
> }  
> elapsed {  
> start\_tag =\> "taskStarted"  
> end\_tag =\> "taskTerminated"  
> unique\_id\_field =\> "sessionID"  
> #timeout =\> 10000  
> new\_event\_on\_match =\> false  
> }

Now I see these outputs in the stdout with the session timeout event

> {  
> "message" =\> "[27/Apr/2015:10:43:50 -0500] 1 ENG NORMAL TOUCH SESSION\_TIMEOUT ",  
> "@timestamp" =\> "2015-04-27T15:43:50.000Z",  
> "timestamp" =\> "27/Apr/2015:10:43:50 -0500",  
> "sessionID" =\> "1",  
> "tags" =\> [  
> [0] "taskTerminated",  
> [1] "elapsed",  
> [2] "elapsed.match"  
> ],  
> "elapsed.time" =\> 15478784.435,  
> "elapsed.timestamp\_start" =\> "2015-04-27T15:41:45.000Z"  
> }

Now I see this elapsed.time = 15478784.435 which is ideally from the doucmentation is in seconds. But if you calculate the actual time between timestamps of the start and timeout events show above it should be just 125 secs.

Could someone pls explain what's going on here and what's 15478784.435 number?

Thanks

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [October 26, 2015, 2:22pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/2 "2015-10-26T14:22:37Z")

</div>

Hello,

Anybody can throw some light on this please?

Thanks

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [October 27, 2015, 6:57pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/3 "2015-10-27T18:57:44Z")

</div>

Anyone? pls give this a try

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [December 1, 2015, 4:50pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/4 "2015-12-01T16:50:58Z")

</div>

could somebody help out on this one

---

<div class="post-metadata">

**Author:** ![inderjeet26](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inderjeet26/32/3870_2.png) [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\
**Post date:** [December 4, 2015, 10:52pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/5 "2015-12-04T22:52:53Z")

</div>

Did somebody tried elapsed filter?

---

<div class="post-metadata">

**Author:** ![amr](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@amr](https://discuss.elastic.co/u/amr)\
**Post date:** [February 29, 2016, 3:10pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/6 "2016-02-29T15:10:40Z")

</div>

## I am not so into Ruby but i looked at the source of elapsed. The following snippet:

# The method is invoked by LogStash every 5 seconds.

## def flush() expired\_elements = [] @mutex.synchronize do increment\_age\_by(5) expired\_elements = remove\_expired\_elements() end return create\_expired\_events\_from(expired\_elements) end

## needs to be (imoo):

# The method is invoked by LogStash every 5 seconds.

## def flush() expired\_elements = [] increment\_age\_by(5) @mutex.synchronize do expired\_elements = remove\_expired\_elements() end return create\_expired\_events\_from(expired\_elements) end

otherwise the elapsed time for every element/event gets increased 5 secs the number of elements/events times. So "increment\_age\_by(5)"needs to be outside the loop!

---

<div class="post-metadata">

**Author:** ![amr](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@amr](https://discuss.elastic.co/u/amr)\
**Post date:** [February 29, 2016, 3:22pm UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/7 "2016-02-29T15:22:33Z")

</div>

## Adding to it! Adding to my previous answer/comment, here is the increment\_age\_by function:

## private def increment\_age\_by(seconds) @start\_events.each\_pair do |key, element| element.age += seconds end end

It looks like it is incrementing for every key, and for every key is already the case in the loop in my previous comment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:09am UTC](https://discuss.elastic.co/t/elapsed-time-filter-for-calculating-session-duration-elapsed-time-is-very-big/32882/8 "2017-07-06T05:09:18Z")

</div>