# Filter Data According to TImeStamp Difference

**URL:** <https://discuss.elastic.co/t/filter-data-according-to-timestamp-difference/110679>\
**Category:** Elasticsearch\
**Created:** [December 7, 2017, 1:33pm UTC](https://discuss.elastic.co/t/filter-data-according-to-timestamp-difference/110679 "2017-12-07T13:33:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohannadsalem](https://avatars.discourse-cdn.com/v4/letter/m/e0b2c6/32.png) [@mohannadsalem](https://discuss.elastic.co/u/mohannadsalem)\
**Post date:** [December 7, 2017, 1:33pm UTC](https://discuss.elastic.co/t/filter-data-according-to-timestamp-difference/110679/1 "2017-12-07T13:33:40Z")

</div>

I am trying to apply a script to grab the difference between two records with this format  
{  
"\_index": "test",  
"\_type": "test",  
"\_id": "AWAwn3lqptselg3AANJ3",  
"\_score": 3.0308797,  
"\_source": {  
"timestamp": 1512385591,  
"plugin\_output": {  
"color": "green",  
},  
"input\_source": "5a2530041673ce1e26dd8595"  
}  
},  
{  
"\_index": "test",  
"\_type": "test",  
"\_id": "AWAwn3luptselg3AANKT",  
"\_score": 3.0308797,  
"\_source": {  
"user\_id": "ict",  
"timestamp": 1512385931,  
"plugin\_output": {  
"color": "red"  
}  
}

where I want to apply the time as filter for the same query to fetch all the records that match the difference between Red - Green is it possible from one query to do so Or not && Why ?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [December 15, 2017, 9:12am UTC](https://discuss.elastic.co/t/filter-data-according-to-timestamp-difference/110679/2 "2017-12-15T09:12:09Z")

</div>

Is there a common entity key (eg deviceID) that is required to join these 2 event docs?  
Do you need to do this for just one event pair or repeat the calculation for many pairs?  
Do you have multiple shards in which case the related data may be held on different machines?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2018, 9:12am UTC](https://discuss.elastic.co/t/filter-data-according-to-timestamp-difference/110679/3 "2018-01-12T09:12:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.