# Get Difference between two date field with ruby filter
**URL:** https://discuss.elastic.co/t/get-difference-between-two-date-field-with-ruby-filter/97100
**Category:** Logstash
**Created:** [August 15, 2017, 12:56pm UTC](https://discuss.elastic.co/t/get-difference-between-two-date-field-with-ruby-filter/97100 "2017-08-15T12:56:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@rkhapre](https://discuss.elastic.co/u/rkhapre)
#### Post date: [August 15, 2017, 12:56pm UTC](https://discuss.elastic.co/t/get-difference-between-two-date-field-with-ruby-filter/97100/1 "2017-08-15T12:56:06Z")
Hi All
I have been trying the ruby code to get the difference between 2 dates
```
Start Date : 2017-06-13T01:17:07.000Z
End Date : 2017-07-13T01:17:10.000Z
```
I need difference between these 2 dates. I have dried this but i get ruby exception error
```
ruby {
init => "require 'time'"
code => "
start = Time.iso8601(event['Start Date'].to_s).to_i;
end = Time.iso8601(event['End Date'].to_s).to_i;
event['timediff'] = start - end;
"
add_tag => ["calculated_time_difference"]
}
```
---
### Author:  [@Supernomad](https://discuss.elastic.co/u/Supernomad)
#### Post date: [August 16, 2017, 1:40am UTC](https://discuss.elastic.co/t/get-difference-between-two-date-field-with-ruby-filter/97100/2 "2017-08-16T01:40:48Z")
Given you have already taken the raw log data that contains the `Start Date` and `End Date` and parsed them into fields of the event. I would first pass the two fields into the following:
```auto
date {
match => ["Start Date", "ISO8601"]
target => "start_date"
}
date {
match => ["End Date", "ISO8601"]
target => "end_date"
}
```
Then you can use the ruby filter like so:
```auto
ruby {
init => "require 'time'"
code => "
diff = event.get('start_date') - event.get('end_date')
event.set('timediff') = diff;
"
add_tag => ["calculated_time_difference"]
}
```
> Note the the `.get` and `.set` are new in the later versions of logstash and depending on the particular version you are using you may need to use the syntax you originally posted, i.e. `event['start_date']`
If you haven't parsed them into fields I would look into using [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html), to pull the fields out of the raw message. another good resource if you are having trouble creating the grok is [grok debugger](https://grokdebug.herokuapp.com/).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 13, 2017, 1:41am UTC](https://discuss.elastic.co/t/get-difference-between-two-date-field-with-ruby-filter/97100/3 "2017-09-13T01:41:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.