How do you use script fields with datetime subtraction

Elastic Stack Kibana
1

I am trying to use scripted fields to subtrack two datetime fields to determine how long it took for a file to processed.

doc.['time_var1'].value - doc.['time_var2'].value

doc being the index name.

I get this error:

Visualize: Request to Elasticsearch failed: {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[rtl_z8lBRrGHGQPtgehi2w]

my time_var1 is something like this: 2016-01-13 16:34:59 the same format for the time_var2.

Is there something am I missing?

2

If I could convert the time_var1 to epoch before doing the math, that would work. But How do I convert date field to epoch in scripted field?

3

gsaray101, I am not sure if you can convert to epoch, but you can convert to other metrics, like day, hour, min, seconds, etc.

Take a look at the docs.