ESQL - diff with NOW()

How can I create a nowdiff:

FROM *.events.* | limit 1 | EVAL mynow=now() | KEEP time,mynow

                    time                    mynow
2023-05-20T03:22:16.976Z 2025-01-17T10:07:54.328Z

But:

FROM *.events.* | limit 1 | EVAL mynow=now()-time | KEEP time,mynow

BadRequestError(400, 'verification_exception', 'Found 1 problem\nline 1:52: [-] has arguments with incompatible types [datetime] and [datetime]')

I would have had a clue if the type was different :slight_smile:

I can subtract timediffs:

FROM *.events.* | limit 1 | EVAL mynow = NOW() - 1 day | KEEP time,mynow

                    time                    mynow
2023-04-30T03:23:04.498Z 2025-01-16T10:15:35.728Z

Thanks

You can use DATE_DIFF. See this example for another dataset:

FROM person
| LIMIT 1
| EVAL age = DATE_DIFF("year", dateOfBirth, NOW())
1 Like