# EQL date difference function
**URL:** https://discuss.elastic.co/t/eql-date-difference-function/339420
**Category:** Elastic Security
**Created:** [July 27, 2023, 10:22am UTC](https://discuss.elastic.co/t/eql-date-difference-function/339420 "2023-07-27T10:22:24Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@j91321](https://discuss.elastic.co/u/j91321)
#### Post date: [July 27, 2023, 10:22am UTC](https://discuss.elastic.co/t/eql-date-difference-function/339420/1 "2023-07-27T10:22:24Z")
Is there a way how to get diff of two dates in EQL? I checked the EQL functions docs, but neither subtract() nor number() seem to work on datetime fields. I know I can probably achieve what I need with ingest pipeline or maybe runtime field, but it seems like a strange omission from EQL functions.
---
### Author:  [@Robert\_Austin](https://discuss.elastic.co/u/Robert_Austin)
#### Post date: [August 14, 2023, 4:30pm UTC](https://discuss.elastic.co/t/eql-date-difference-function/339420/2 "2023-08-14T16:30:27Z")
Hi and thanks for posting.
Unfortunately EQL does not support date functions. You can define a runtime mapping in your EQL query to do the calculation.
```auto
GET /logs-*/_eql/search?filter_path=-hits.events._source
{
"runtime_mappings": {
"ms_between_ingest_and_timestamp": {
"type": "long",
"script": {
"source": """
long timestamp_millis = doc['@timestamp'].value.getMillis();
long ingested_millis = doc['event.ingested'].value.getMillis();
emit(ingested_millis - timestamp_millis);
"""
}
}
},
"filter": {
"bool": {
"must": [
{
"exists": {
"field": "@timestamp"
}
},
{
"exists": {
"field": "event.ingested"
}
}
]
}
},
"query": """
any where ms_between_ingest_and_timestamp > 1000
""",
"fields": [
"@timestamp",
"event.ingested",
"ms_between_ingest_and_timestamp"
]
}
```
In the above example I subtract `event.ingested` from the `@timestamp`. The resulting time interval is in milliseconds. I use `filter` to ensure that this only runs on documents that have both `event.ingested` and `@timestamp`. Lastly, I use the runtime field, `ms_between_ingest_and_timestamp` in the EQL query.
Sorry for the inconvenience.
Best regards,
Robert
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2023, 4:30pm UTC](https://discuss.elastic.co/t/eql-date-difference-function/339420/3 "2023-09-11T16:30:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.