# Handling running time duration format "ddd:hh:mm:ss"

**URL:** <https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395>\
**Category:** Logstash\
**Created:** [March 29, 2017, 1:48am UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395 "2017-03-29T01:48:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bigtoerag](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@bigtoerag](https://discuss.elastic.co/u/bigtoerag)\
**Post date:** [March 29, 2017, 1:48am UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395/1 "2017-03-29T01:48:38Z")

</div>

Has anyone needed to handle a custom duration field from servers showing running time?  
I am just starting out and trying to get a handle on the best way to handle it without creating a grok mutate mess to convert to seconds or similar.

I have created a custom grok pattern to extract it nicely in the above string format so the next step is to handle the days field as the odd one out.

Am I missing something as easy as a custom mapping to create my own duration field for kibana?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [March 29, 2017, 5:36pm UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395/2 "2017-03-29T17:36:42Z")

</div>

I don't think there is a nice way to go around it. ElasticSearch does not support custom data type.

Eventually, converting it to seconds would be the most convenient and hassle-free for you in the long run.  
For what it's worth, here's how you can avoid lengthy groks.

Suppose you have a _duration_ field with a value of "10:12:50:50", the code below would replace it with the equivalent in seconds.

`
filter {
  ruby {
    code => "
      d, h, m, s = event.get('duration').split(':').map{|str| str.to_i}
      event.set('duration', d*86400 + h*3600 + m*60 + s)
    "
  }
}`

---

<div class="post-metadata">

**Author:** ![bigtoerag](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@bigtoerag](https://discuss.elastic.co/u/bigtoerag)\
**Post date:** [March 29, 2017, 11:18pm UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395/3 "2017-03-29T23:18:03Z")

</div>

I will give that a try as I have the field coming in from many docs so I am trying to be simple and clean to run everything through the one filter where possible.

Thanks for the quick response, my productivity today will likely go up!

---

<div class="post-metadata">

**Author:** ![bigtoerag](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@bigtoerag](https://discuss.elastic.co/u/bigtoerag)\
**Post date:** [March 30, 2017, 12:23am UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395/4 "2017-03-30T00:23:37Z")

</div>

Just checked and confirmed solved!

 ![](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d88469311737b5e0f366562ac26e256f8c2e2fbb.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2017, 12:23am UTC](https://discuss.elastic.co/t/handling-running-time-duration-format-ddd-hh-mm-ss/80395/5 "2017-04-27T00:23:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.