How calculate time différence between two rows in csv file?

[Emna1 (Linda)]

Hi, Please i need to calculate différence of time between two rows in my file

My csv file it looks like this
ent_sort , Date , car
enter, 2020-04-28 05:04:02 , c1
sortie , 2020-04-28 10:04:02 , c1
enter , 2020-04-28 05:04:02 , c3
sortie , 2020-04-28 10:04:02 , c2
enter , 2020-04-28 05:04:02 , c2
sortie , 2020-04-28 12:04:02 , c3

Blockquote

So i want calculate for c1 time différence and for c2 .....please any help?

[Badger]

Use an aggregate filter (see example 5) or an elapsed filter.

Make sure to set pipeline.workers to 1 and disable java_execution.

[Emna1 (Linda)]

Hi, i try elapsed filter and i add this two line in logstash.yml

Blockquote
elapsed {
start_tag => "taskStarted"
end_tag => "taskEnded"
add_tag => ["time_elapsed"]
}

Blockquote
pipeline.workers: 1
pipeline.java_execution: false

Blockquote
but i have no result the time différence not exist

[Badger]

How did you add the taskStarted and taskEnded tags to the events? Something like this?...

if [ent_sort] == "sortie" { mutate { add_tag => [ "taskEnded" ] } }

[Emna1 (Linda)]

I did this code

Blockquote
if [ent_sortie] == "sortie" { mutate { add_tag => [ "taskEnded" ] } }
else if [ent_sort] == "enter" { mutate { add_tag => [ "taskStarted" ] } }
elapsed {
unique_id_field => "Car"
start_tag => "taskStarted"
end_tag => "taskEnded"
add_tag => ["time_elapsed"]
}

Blockquote

the output in console

Blockquote
........
"tags" => [
[0] "taskEnded",
[1] "time_elapsed",
[2] "elapsed_end_without_start"

[Badger]

@Emna1

if [ent_sortie] == "sortie" { mutate { add_tag => [ "taskEnded" ] } }
else if [ent_sort] == "enter" ...

That's checking the value of two different fields.