# How to add an additional field in elastic search ?I want to create an additional field to show time difference between two events in the new created field

**URL:** https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957
**Category:** Kibana
**Created:** [May 22, 2024, 5:48am UTC](https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957 "2024-05-22T05:48:15Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![gaurow.deshmukh](https://avatars.discourse-cdn.com/v4/letter/g/ebca7d/32.png) [@gaurow.deshmukh](https://discuss.elastic.co/u/gaurow.deshmukh)
#### Post date: [May 22, 2024, 5:48am UTC](https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957/1 "2024-05-22T05:48:15Z")

</div>

I want to create an additional field to show time difference between two events..

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [May 22, 2024, 8:41am UTC](https://discuss.elastic.co/t/how-to-add-an-additional-field-in-elastic-search-i-want-to-create-an-additional-field-to-show-time-difference-between-two-events-in-the-new-created-field/359957/2 "2024-05-22T08:41:05Z")

</div>

Not easy. The EQL feature might help you to do that. See [EQL search | Elasticsearch Guide [8.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html#eql-search-sequence). But I'm not sure on how to use that in Kibana.

I don't know (yet) how to do that with ES|QL if doable.

IMHO The best thing to do is to compute that at index time. The [Logstash aggregate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html) for example could help with that.
