How to do Calculation in Elasticsearch Query

Hi there,

to continue discussion below, I decided to create a new topic. please read the topic below first so you can understand it.

OK, so the next question is how if i use elasticsearch query to calculate expire date of a certificate using field below and I subtract it with today's date. is it possible?
image

if that is possible, maybe i can call the value of the tags field too so that my script can work with that

Thanks

You know Uptime/ Heartbeat does all that for you...cert check and alert.

But yes you can create a runtime field to calculate the difference assuming you are on a fairly recent version.

I had a post on that let me look

Perhaps this will help

sure, but i need to call the value of the tags field from heartbeat index to separate cert that have auto-renew tags, and manual-renew tags and it's not possible with TLS Cert type

Ok...Did you look at the example I gave you? It shows how to calculate elapsed time. You could add a runtime field to your mapping and it would always be available for you.

You could tag the cert checks as well heartbeat if you know the types when you can figure... Then the data would be there.

do you have example for 7.17 version? i didn't found Data Views menu in stack management here

It's under index pattern which is the 7.17 version of data views. Data views came in 8.x.

You can test it out in the index pattern, but if it's something that you're going to use quite a bit or query against you will actually need to add it to the mapping.

Get it working in the index pattern first which then you'll be able to see it in discover first and then we can translate it over to the mapping