# How to add field for the duration of a session?

**URL:** <https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916>\
**Category:** Logstash\
**Created:** [May 19, 2015, 5:11pm UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916 "2015-05-19T17:11:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeroc](https://avatars.discourse-cdn.com/v4/letter/y/65b543/32.png) [@yeroc](https://discuss.elastic.co/u/yeroc)\
**Post date:** [May 19, 2015, 5:11pm UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916/1 "2015-05-19T17:11:28Z")

</div>

We have some logs where some critical information (such as username) is logged once at the beginning of a user's session (these are web applicaiton logs) and we'd like to associate this information in a field for all the following events associated with that same session\_id. Is there a way to do this in logstash? I thought this would be something that would come up more commonly but I didn't turn up anything in any searches. The idea would be to store a value into a persistent hash that could then be retrieved on subsequent events. Typically, a session\_id or similar would be used and there'd have to be some mechanism to delete the values from the hash to keep it from growing without bound. The closest filter I could find is the 'elapsed' filter.

Thanks,  
Corey

---

<div class="post-metadata">

**Author:** ![rastro](https://avatars.discourse-cdn.com/v4/letter/r/b782af/32.png) [@rastro](https://discuss.elastic.co/u/rastro)\
**Post date:** [May 19, 2015, 6:57pm UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916/2 "2015-05-19T18:57:24Z")

</div>

Check out the elapsed{} filter, which can compute the duration.

---

<div class="post-metadata">

**Author:** ![yeroc](https://avatars.discourse-cdn.com/v4/letter/y/65b543/32.png) [@yeroc](https://discuss.elastic.co/u/yeroc)\
**Post date:** [May 19, 2015, 7:24pm UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916/3 "2015-05-19T19:24:06Z")

</div>

Yes, as mentioned in my original post, I've seen the elapsed filter which comes closest to what I want but note that I'm not trying to measure elapsed times. I'm trying to capture a value during the creation of a session so that I can log it with all events associated with that session later on. Picture a username which is logged at login time but all that is logged thereafter is a sessionid but I want to then include the username on all my events stored in elasticsearch to ease diagnosis of issues.

Corey

---

<div class="post-metadata">

**Author:** ![rastro](https://avatars.discourse-cdn.com/v4/letter/r/b782af/32.png) [@rastro](https://discuss.elastic.co/u/rastro)\
**Post date:** [May 19, 2015, 8:14pm UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916/4 "2015-05-19T20:14:41Z")

</div>

You could use the elapsed filter as a prototype of how to build that cache as a filter.

I'm currently doing a similar process via a small external python script from cron.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/how-to-add-field-for-the-duration-of-a-session/916/5 "2017-07-06T05:39:38Z")

</div>

Closed on July 6, 2017, 5:39am UTC