# Find function execution time based on start/end timestamps

**URL:** <https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698>\
**Category:** Kibana\
**Created:** [November 7, 2017, 2:20pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698 "2017-11-07T14:20:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gavenkoa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gavenkoa/32/23899_2.png) [@gavenkoa](https://discuss.elastic.co/u/gavenkoa)\
**Post date:** [November 7, 2017, 2:20pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698/1 "2017-11-07T14:20:55Z")

</div>

Our ES index has timestamps, markers for function start and end (in separate documents) and other fields which identify execution environment (ip+pid+tid).

By fixing ip+pid+tid and calculating difference between timestamps of subsequent (end - start) I'll get execution time of function.

Are there any aggregation that looks to ordered series of documents and perform aggregation between two adjusted documents?

Like from:

```
{"ip": "192.168.0.1", "pid": "2345", "tid": "slave-3",
    "@timestamp": "2017-01-01 00:00:00", "msg": "start calc"}
{"ip": "192.168.0.1", "pid": "2345", "tid": "slave-3
   ", "@timestamp": "2017-01-01 00:01:00", "msg": "end calc"}
{"ip": "192.168.0.2", "pid": "1234", "tid": "slave-2",
   "@timestamp": "2017-01-01 00:00:02", "msg": "start calc"}
{"ip": "192.168.0.2", "pid": "1234", "tid": "slave-2",
    "@timestamp": "2017-01-01 00:00:05", "msg": "end calc"}

```

I can found that max execution time is 1 minute, and min execution time is 3 sec.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 7, 2017, 2:57pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698/2 "2017-11-07T14:57:55Z")

</div>

You might be able to use [logstash](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html) to augment the documents with this information. Check the value of the msg field and add tags for start and end then use an elapsed filter.

---

<div class="post-metadata">

**Author:** ![stevedearl](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@stevedearl](https://discuss.elastic.co/u/stevedearl)\
**Post date:** [November 7, 2017, 3:09pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698/3 "2017-11-07T15:09:03Z")

</div>

Hi Gavenkoa,

I had the same issue as you - I have 'transaction start' and 'transaction end' events in a database that I wanted to work out the elapsed time of.

You should take a look at the elapsed-filter plugin. You basically configure it to watch for new events and you give it a field or combination of fields which would result in a unique ID with which to correlate the pair of start/end events. The elapsed filter then keeps a record of 'start' events and when it finds a matching 'end' event it calculates the time difference and inserts it as a new field in the end event (there are some other options).

As I say, it worked great for me.

Cheers,  
Steve

---

<div class="post-metadata">

**Author:** ![gavenkoa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gavenkoa/32/23899_2.png) [@gavenkoa](https://discuss.elastic.co/u/gavenkoa)\
**Post date:** [November 7, 2017, 3:59pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698/4 "2017-11-07T15:59:00Z")

</div>

> [@Badger](#):
>
> You might be able to use logstash to augment the documents with this information. Check the value of the msg field and add tags for start and end then use an elapsed filter.

Thanks for suggestion!

With your help I found some examples to start with:

> <https://stackoverflow.com/questions/37353365/calculating-time-between-events>

> <https://stackoverflow.com/questions/29020545/logstash-elapsed-filter>

Unfortunately I ingest data directly to ES without Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2017, 3:59pm UTC](https://discuss.elastic.co/t/find-function-execution-time-based-on-start-end-timestamps/106698/5 "2017-12-05T15:59:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.