# Filebeat iis module time taken field

**URL:** <https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504>\
**Category:** Beats\
**Tags:** beats-module\
**Created:** [June 9, 2021, 10:02pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504 "2021-06-09T22:02:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Garry](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@Garry](https://discuss.elastic.co/u/Garry)\
**Post date:** [June 9, 2021, 10:02pm UTC](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504/1 "2021-06-09T22:02:28Z")

</div>

Using the filebeat iis module in v7.13, I cannot explicitly see the time taken field. Am I missing something or has it been replaced with event duration?  
The iis logs exports all fields.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 10, 2021, 3:35am UTC](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504/2 "2021-06-10T03:35:49Z")

</div>

Yes and `event.duration`

So if you look at the definition of event.duration [here](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-ecs.html)

`event.duration`

Duration of the event in **nanoseconds**. If event.start and event.end are known this value should be the difference between the end and start time.

```auto
type: long
format: duration

```

So it looks like it is turned from **ms** (probably what the `ctx.temp.duration) it is _ **multiplied** _ by 1,000,000 in the pipeline to become nanoseconds.

Take a look at a discussion in [this](https://discuss.elastic.co/t/reason-for-scale-1000000-for-iis-event-duration/273762) thread

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2021, 5:35am UTC](https://discuss.elastic.co/t/filebeat-iis-module-time-taken-field/275504/3 "2021-07-08T05:35:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.