# How to calculate timediff of two fields in the same event
**URL:** https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417
**Category:** Logstash
**Created:** [November 5, 2017, 11:09am UTC](https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417 "2017-11-05T11:09:02Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ganesh\_Venkataraman](https://discuss.elastic.co/u/Ganesh_Venkataraman)
#### Post date: [November 5, 2017, 11:09am UTC](https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417/1 "2017-11-05T11:09:02Z")
LOGSTASH - I would like to calculate time taken in seconds for two timestamps in the same event and store it in a different field say "e2e\_latency\_in\_seconds".
The timestamps are in different format. I have successfully normalized them into one format and stored into elasticsearch however I am unable to create a new field using logstash plugin. Please help. I don't think I can use the elapsed plugin as it is for two different events but my case is just one event.
```
date{
match => ["tds_audittimestamp", "UNIX_MS"]
target => "tds_audittimestamp"
}
date{
match => ["trade_insertion_at_source", "yyyy/MM/dd HH:mm:ss.SSS"]
timezone => "UTC"
target => "trade_insertion_at_source"
}
```
I have calculated using kibana scripted field but I want to achieve this in logstash as I cannot used scripted fields in Grafana.
---
### Author:  [@novoselrok](https://discuss.elastic.co/u/novoselrok)
#### Post date: [November 5, 2017, 11:29am UTC](https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417/2 "2017-11-05T11:29:15Z")
Try using the Ruby filter plugin:
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html)
---
### Author:  [@Ganesh\_Venkataraman](https://discuss.elastic.co/u/Ganesh_Venkataraman)
#### Post date: [November 6, 2017, 7:58am UTC](https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417/3 "2017-11-06T07:58:14Z")
I don't know ruby so found it very difficult. I have used below post to find the solution.
> [@Logstash Ruby filter to subtract difference between two timestamps in single event](https://discuss.elastic.co/t/logstash-ruby-filter-to-subtract-difference-between-two-timestamps-in-single-event/32580/4):
>
> I think you could just do something like: ruby { init =\> "require 'time'" code =\> "event['time\_difference'] = event['received\_at'] - event['@timestamp'];" }
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2017, 7:58am UTC](https://discuss.elastic.co/t/how-to-calculate-timediff-of-two-fields-in-the-same-event/106417/4 "2017-12-04T07:58:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.