How to get total number of hours in time selection in kibana

Elastic Stack Kibana
1

I have a time_stamp field in an index in ES. I want to calculate number of hours between time range selection available in kibana within the limits
min(time_Stamp) < time_selection_in_kibana < max(time_stamp)

2

Hello, this is not currently possible, but it will be possible soon.
The only thing blocking is the fact that Visual Builder cannot use scripted fields yet. https://github.com/elastic/kibana/issues/13928 This should be coming soon with the new visual editor in Kibana.

What you need to do when that is available is to create a scripted field that stores the timestamp value as a number ( doc['@timestamp'].value.toInstant().toEpochMilli() is what I tested that works) and then create a Max and a Min metric on it in Visual Builder. Then a Math metric can provide the Sum of the diff between Max and Min (because Max and Min are set for each bucket and you need the total for all buckets).

Without the scripted field you could use the copy_to feature from Elasticsearch which would create the epoch_millis field as a number field at ingest time: https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html
I'm thinking something like this:

PUT my_index
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date",
        "copy_to": "epoch" 
      },
      "epoch": {
        "type": "long"
      }
    }
  }
}

LE: the part above doesn't work.
You can only achieve it at ingest, either via the Ingest Processor function in Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html or in the Logstash config if you're using that for ingesting the data.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.