# Find time difference between series of events with uniqueid
**URL:** https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911
**Category:** Logstash
**Created:** [December 7, 2020, 9:09pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911 "2020-12-07T21:09:53Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@GokulD](https://discuss.elastic.co/u/GokulD)
#### Post date: [December 7, 2020, 9:09pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/1 "2020-12-07T21:09:53Z")
Hi ,
I have requirement where I have series of events that has a unique trace id. I want to find and take the timestamp from the first and last event of this id and find the difference.
Since I dont have any start and end tag to track for those events, i'm not able to use elpased filter. Is there a way with which I can achieve this requirement ?
Below is the sample log:
e65f915e-d3c4-471b-89eb-3613cd1f3c54 asd {"timestamp":"2020-10-29 08:18:48.893"}
e65f915e-d3c4-471b-89eb-3613cd1f3c54 def {"timestamp":"2020-10-29 08:18:49.111"}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 7, 2020, 9:16pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/2 "2020-12-07T21:16:35Z")
You may be able to use an aggregate filter. See [example 3](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example3) in the documentation.
An example of calculating time difference is [here](https://discuss.elastic.co/t/time-difference-between-two-fields-in-a-csv-using-ruby-plugin/122115/2).
---
### Author:  [@GokulD](https://discuss.elastic.co/u/GokulD)
#### Post date: [December 7, 2020, 9:31pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/3 "2020-12-07T21:31:49Z")
Thank you so much for your reply.
However for calculating the timedifference I should be able to get the timestamp of the first event and last event from the series of events of the same trace id. Does aggregate have option for this?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 7, 2020, 10:03pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/4 "2020-12-07T22:03:03Z")
In the aggregate filter you would use some code like
```
code => '
map["firstEvent"] ||= event.get("@timestamp")
map["lastEvent"] = event.get("@timestamp")
'
timeout_code => '
require "time"
starttime = Time.iso8601(event.get("firstEvent").to_s).to_f
endtime = Time.iso8601(event.get("lastEvent").to_s).to_f
event.set("overallTime", endtime - starttime)
'
```
---
### Author:  [@GokulD](https://discuss.elastic.co/u/GokulD)
#### Post date: [December 10, 2020, 7:16pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/5 "2020-12-10T19:16:22Z")
Thanks very much, it worked!!!.
We also have requirement where on the same series of event instead of taking the timestamp for the last event we want to take the timestamp of a event in-between and find difference based on that.
For example we have the below series of events
65f915e-d3c4-471b-89eb-3613cd1f3c54 asd {"timestamp":"2020-10-29 08:18:48.893"}
e65f915e-d3c4-471b-89eb-3613cd1f3c54 def {"timestamp":"2020-10-29 08:18:49.111","status":"COMPLETED"}
e65f915e-d3c4-471b-89eb-3613cd1f3c54 def {"timestamp":"2020-10-29 08:18:49.111"}
So based on the key status is it possible to take the timestamp of that event and calculate ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 10, 2020, 8:45pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/6 "2020-12-10T20:45:09Z")
> [@Badger](#):
>
> `map["lastEvent"] = event.get("@timestamp")`
You could replace that with something like
```
if event.get("message").include?("COMPLETED")
map["lastEvent"] = event.get("@timestamp")
end
```
You may then need error handling if there are cases where that string does not occur, so lastEvent never gets set.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2021, 8:45pm UTC](https://discuss.elastic.co/t/find-time-difference-between-series-of-events-with-uniqueid/257911/7 "2021-01-07T20:45:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.