# Increment @timestamp with a float field

**URL:** <https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915>\
**Category:** Logstash\
**Created:** [May 15, 2018, 10:55am UTC](https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915 "2018-05-15T10:55:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Federico\_Foschini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/federico_foschini/32/31209_2.png) [@Federico\_Foschini](https://discuss.elastic.co/u/Federico_Foschini)\
**Post date:** [May 15, 2018, 10:55am UTC](https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915/1 "2018-05-15T10:55:33Z")

</div>

Hello,  
I'm parsing some logs and I have a timestamp field (that goes in `@timestamp`) and a float field mapped in `duration`.  
What I'm trying to do is to copy the `@timestamp` to another field, and then add the `duration` to the original `@timestamp`. I've tried this solution:

```auto
ruby {
                code => 'event.set("times_created", event.get("@timestamp"))'
                id => "copy_date"
            }
            ruby {
                code => 'event.set("@timestamp", event.get("@timestamp") + event.get("duration"))'
                id => "add_duration"
            }
        }

```

But it fail with the following error:  
`Ruby exception occurred: wrong argument type Time (expected LogStash::Timestamp)`

What am I doing wrong?  
For referenc this is a document indexed by elasticsearch:

```auto
{
  "_index": "conn",
  "_type": "doc",
  "_id": "05pqY2MBZbpJx82QgqXO",
  "_version": 1,
  "_score": null,
  "_source": {
    "@version": "1",
    "duration": 0.01403,
    "history": "Dd",
    "orig_pkts": 1,
    "tunnel_parents": [],
    "service": "dns",
    "@timestamp": "2018-05-15T10:48:18.335Z",
    "orig_bytes": 41,
    "resp_pkts": 1,
    "conn_state": "SF",
    "times_created": "2018-05-15T10:48:18.335Z",
    "proto": "udp",
    "dst_port": 53,
    "tags": [
      "conn"
    ],
    "src_port": 35180,
    "path": "/var/log/conn.log",
    "local_orig": true,
    "resp_bytes": 91,
    "orig_ip_bytes": 69,
    "missed_bytes": 0,
    "resp_ip_bytes": 119,
    "local_resp": false,
    "uid": "CtVSb32rVU7FY8Owa1",
    "dst_addr": "134.64.2.50",
    "host": "logstash",
    "src_addr": "172.20.0.156"
  },
  "fields": {
    "@timestamp": [
      "2018-05-15T10:48:18.335Z"
    ],
    "times_created": [
      "2018-05-15T10:48:18.335Z"
    ]
  },
  "highlight": {
    "tags": [
      "@kibana-highlighted-field@conn@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1526381298335
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 15, 2018, 2:19pm UTC](https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915/2 "2018-05-15T14:19:33Z")

</div>

You want to add duration or subtract it? Anyways, you can always take the long way around...

```
  ruby {
    code => 'event.set("[@metadata][timestamp]", (event.get("@timestamp") + event.get("duration")).strftime("%Y-%m-%dT%H:%M:%S.%LZ"))'
    id => "add_duration"
  }
  date { match => ["[@metadata][timestamp]", "ISO8601" ] }
```

---

<div class="post-metadata">

**Author:** ![Federico\_Foschini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/federico_foschini/32/31209_2.png) [@Federico\_Foschini](https://discuss.elastic.co/u/Federico_Foschini)\
**Post date:** [May 15, 2018, 3:44pm UTC](https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915/3 "2018-05-15T15:44:21Z")

</div>

I'd like to add duration.

Your solution works as intended! Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2018, 3:44pm UTC](https://discuss.elastic.co/t/increment-timestamp-with-a-float-field/131915/4 "2018-06-12T15:44:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.