# Help with time based data

**URL:** <https://discuss.elastic.co/t/help-with-time-based-data/93105>\
**Category:** Logstash\
**Created:** [July 14, 2017, 3:27am UTC](https://discuss.elastic.co/t/help-with-time-based-data/93105 "2017-07-14T03:27:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahongyun](https://avatars.discourse-cdn.com/v4/letter/a/c77e96/32.png) [@ahongyun](https://discuss.elastic.co/u/ahongyun)\
**Post date:** [July 14, 2017, 3:27am UTC](https://discuss.elastic.co/t/help-with-time-based-data/93105/1 "2017-07-14T03:27:05Z")

</div>

Hi all,

I have the following log information.

```
JOB_NAME | START | STOP
MX_DATES | 2017/06/08 16:50:53 | 2017/06/08 16:55:57
MX_DATES | 2017/06/09 23:50:57 | 2017/06/09 23:57:23
MX_DATES | 2017/06/10 16:49:23 | 2017/06/10 17:00:12
MX_DATES | 2017/06/11 23:58:19 | 2017/06/12 00:10:09
MX_DATES | 2017/06/12 16:23:23 | 2017/06/12 17:00:48
...

```

I would like to use kibana line visualization for START & STOP on the same graph with the Y\_AXIS being time and X-AXIS being the date of START\_TIME.

The issue i have here is that some of the END is after 00:00:00 which means that the STOP is not always above the START and this causes the line visualization to be wrong.

I have a logic that might work but i am not sure if logstash is able to configure it that way.

Step 1 : create variables start\_time and stop\_time which are just the time in the START / STOP field  
Step 2 : create variable start\_date and stop\_date which are just the date in the START / STOP field  
Step 3 : create variable stop\_time\_adjusted  
if [start\_date == stop\_date] then stop\_time\_adjusted=stop\_time  
if [start\_date != stop\_date] then stop\_time\_adjusted=stop\_time+24:00:00

Step 4: for the line creation we just start\_time and stop\_time\_adjusted with start\_date as x-axis

Step 1 and 2 are fine; step 3 is the one i am unsure about. I think it requires a lot of mutating to the correct data type.

If someone has a better method, please share ^^

Help would be greatly appreciated

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [July 21, 2017, 4:07pm UTC](https://discuss.elastic.co/t/help-with-time-based-data/93105/2 "2017-07-21T16:07:53Z")

</div>

There are some answers here:

> <https://stackoverflow.com/questions/38069675/math-functions-in-logstash>

The last answer was by Val Crettaz, a very knowledgable chap and a community maintainer of some plugins.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2017, 4:08pm UTC](https://discuss.elastic.co/t/help-with-time-based-data/93105/3 "2017-08-18T16:08:06Z")

</div>

Closed on August 18, 2017, 4:08pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.