# How to calculate the total time a user was logged in/out per day?

**URL:** <https://discuss.elastic.co/t/how-to-calculate-the-total-time-a-user-was-logged-in-out-per-day/134895>\
**Category:** Elasticsearch\
**Created:** [June 7, 2018, 6:27am UTC](https://discuss.elastic.co/t/how-to-calculate-the-total-time-a-user-was-logged-in-out-per-day/134895 "2018-06-07T06:27:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticfour](https://avatars.discourse-cdn.com/v4/letter/e/e47c2d/32.png) [@elasticfour](https://discuss.elastic.co/u/elasticfour)\
**Post date:** [June 7, 2018, 6:27am UTC](https://discuss.elastic.co/t/how-to-calculate-the-total-time-a-user-was-logged-in-out-per-day/134895/1 "2018-06-07T06:27:46Z")

</div>

Hi everyone!

I've a simple log of **users logging in and out** , stored in Elasticsearch:

```
 | datetime | user | action |
 -----------------------------------------
 | 2018-06-06 10:00:00 | john | in |
 | 2018-06-06 15:00:00 | john | out |
 | 2018-06-06 18:00:00 | john | in |
 | 2018-06-06 20:00:00 | john | out |
 | ... | ... | ... |

```

The user **john was logged in for 7 hours** _(10:00-15:00 & 18:00-20:00)_, contrary we expect john being logged out for 17 hours (24 hours - 7 hours).

**Desired output:**

```
| date | user | in | out | 
|-------------------------------|
| 2018-06-06 | john | 7 | 17 |
| ... | ... | ... | ... | 

```

I found a promising [plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html), but would like to solve it **without logstash**.

(How) can I achieve this, any idea?  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2018, 6:32am UTC](https://discuss.elastic.co/t/how-to-calculate-the-total-time-a-user-was-logged-in-out-per-day/134895/2 "2018-07-05T06:32:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
