# How to calculate time difference between two events in postprocessing?

**URL:** <https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023>\
**Category:** Kibana\
**Created:** [October 11, 2018, 9:34am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023 "2018-10-11T09:34:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [October 11, 2018, 9:34am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023/1 "2018-10-11T09:34:04Z")

</div>

Hi there,

I have logs which contain a log line for starting and finishing a process. it looks like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1c225c23e2e9e0d731c4946b68affa768847d64.png).

I need the time difference between the "tux state retrieved" and "tux state retrieved". Since the data is already indexed, I would like to know, if there is an option to calculate this in kibana or timelion as postprocessing.

I am aware that there are possibilities of calculating it on index times in logstash. I will check this in future.

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\
**Post date:** [October 11, 2018, 10:44am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023/2 "2018-10-11T10:44:13Z")

</div>

This would be possible with scripted fields if the time of start and finish are fields within the same document. Then a scripted field could be added to calculate the difference between those two fields. It is not possible to distill this information from your current structure because there is no relationship between the start and finish documents.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2018, 10:44am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-two-events-in-postprocessing/152023/3 "2018-11-08T10:44:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.