How to do Calculation in Elasticsearch Query

You know Uptime/ Heartbeat does all that for you...cert check and alert.

But yes you can create a runtime field to calculate the difference assuming you are on a fairly recent version.

I had a post on that let me look

Perhaps this will help