# Hot to get a duration value extracted from field message into an new field

**URL:** <https://discuss.elastic.co/t/hot-to-get-a-duration-value-extracted-from-field-message-into-an-new-field/121888>\
**Category:** Elasticsearch\
**Created:** [February 28, 2018, 4:22pm UTC](https://discuss.elastic.co/t/hot-to-get-a-duration-value-extracted-from-field-message-into-an-new-field/121888 "2018-02-28T16:22:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sklein](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@sklein](https://discuss.elastic.co/u/sklein)\
**Post date:** [February 28, 2018, 4:22pm UTC](https://discuss.elastic.co/t/hot-to-get-a-duration-value-extracted-from-field-message-into-an-new-field/121888/1 "2018-02-28T16:22:48Z")

</div>

I am hardly trying to extract the Duration value (in the example below: 10.400) using grok and to create a field Conference\_duration.

The reason for the extraction is that I would like to summarize it or to receive an avarage value based on a specific timeframe

Any idea how to do this? I am done 🙂

\<134\>Feb 27 21:58:03.439 xxxxnode01 2018-02-27 21:58:03,439 Level="INFO" Name="administrator.conference" Message="Conference has been stopped." Conference="Heinz VMR" Service-tag="" Service-type="conference" Duration="10.400"

---

<div class="post-metadata">

**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\
**Post date:** [February 28, 2018, 9:50pm UTC](https://discuss.elastic.co/t/hot-to-get-a-duration-value-extracted-from-field-message-into-an-new-field/121888/2 "2018-02-28T21:50:59Z")

</div>

what is the grok statement you have created to parse the data?

you can test your parsing at [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 9:51pm UTC](https://discuss.elastic.co/t/hot-to-get-a-duration-value-extracted-from-field-message-into-an-new-field/121888/3 "2018-03-28T21:51:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.