# Get duration between 2 dates in logs

**URL:** <https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155>\
**Category:** Logstash\
**Created:** [January 14, 2021, 4:45pm UTC](https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155 "2021-01-14T16:45:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Chichi](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@A\_Chichi](https://discuss.elastic.co/u/A_Chichi)\
**Post date:** [January 14, 2021, 4:45pm UTC](https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155/1 "2021-01-14T16:45:47Z")

</div>

Hello,

I would like to get the duration of a job depending on my logs. I've checked this link : [Documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html#plugins-filters-aggregate-example1) and this one [Elastic forum](https://discuss.elastic.co/t/calculate-time-difference-between-two-dates-start-date-and-end-date-of-an-log-file/178916) which is exactly what I would like to do but I don't find the solution...

here is a sample of my log :

```auto
2021-01-14 17:01:27;26812;Job1;subjob1;begin;;
2021-01-14 17:01:42;26812;Job1;subjob1;end;success;

```

Here is the grok :

```auto
%{TIMESTAMP_ISO8601:date_log};%{INT:services_id};%{DATA:job};%{DATA:subjob};%{DATA:progress};%{DATA:status};

```

I would like to have this output :

```auto
{
  "services_id": "26812",
  "subjob": "subjob1",
  "date_log": "2021-01-14 17:01:42",
  "progress": "end",
  "job": "Job1",
  "status": "success",
  "duration": "15"
}

```

Here is what I've tried :

```auto
filter {
  grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:date_log};%{INT:services_id};%{DATA:job};%{DATA:subjob};%{DATA:progress};%{DATA:status};" }
  }

  date {
      match => ["date_log", "yyyy-MM-dd HH:mm:ss"]
  }

  if [progress] == "begin" {
    aggregate {
      task_id => "%{services_id}"
      code => "map['date_begin'] = event.get('date_log')"
      map_action => "create"
    }
  }

  if [progress] == "end" {
    aggregate {
      task_id => "%{services_id}"
      code => "
        require 'time'
        event.set('duration', Time.parse(event.get('date_log'))-Time.parse(map['date_begin']))"
      map_action => "update"
      end_of_task => true
      timeout => 120
    }
  }
}

```

This configuration gives me random 0 in some logs.

Sometimes I get `"duration": "0"` (which is not the case) and most of the time I get `"duration": ""`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2021, 4:45pm UTC](https://discuss.elastic.co/t/get-duration-between-2-dates-in-logs/261155/2 "2021-02-11T16:45:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.