How i can determine the difference of two fields(ROWS) in kibana

[Raja_Kushwah]

Please find the attached screenshot.!!

I am trying to create a new filed name -- 'msec different' and its value will be '0' when the event name is a start and 2nd value will be the difference of [2nd 'msecs' value - 3rd 'msecs' value] and goes on...

I want to do it in kibana only ..either by scripted field or you can also suggest any other way to do it.

Thanks

[Wolfram_Haussig]

Hi,

I don't think that scripted fields are able to do this as scripted fields only have access to a single document.

I think this would be possible with LogStash:

• Create a logstash pipeline with ElasticSearch input using your index
• Add aggregate filter
  • task_id seems to be your execkey
  • on START, store the time in the aggregate filter
  • on all others update the current event with the time difference
• Output result to ElasticSearch

Best regards
Wolfram

[Hendrik_Muhs]

This should be possible using a transform, transform is a elasticsearch feature, but there is a kibana UI for it.

It seems you want to group_by execkey, the duration can be calculated as aggregation, however you need some scripting for that. We have an example for that in the docs. You need at least 7.5 for this, newer is better as the UI got a lot of enhancements with every new release.

In a nutshell the transform will create a 2nd index which you can further analyze, e.g. to get the average duration for all sessions, you can as well visualize the transformed data. Using the continuous mode, you can automatically transform new incoming data on the fly.