# Interval between timestamps / duration of session

**URL:** <https://discuss.elastic.co/t/interval-between-timestamps-duration-of-session/22309>\
**Category:** Elasticsearch\
**Created:** [February 21, 2015, 1:52pm UTC](https://discuss.elastic.co/t/interval-between-timestamps-duration-of-session/22309 "2015-02-21T13:52:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tobi\_Wo](https://avatars.discourse-cdn.com/v4/letter/t/45deac/32.png) [@Tobi\_Wo](https://discuss.elastic.co/u/Tobi_Wo)\
**Post date:** [February 21, 2015, 1:52pm UTC](https://discuss.elastic.co/t/interval-between-timestamps-duration-of-session/22309/1 "2015-02-21T13:52:14Z")

</div>

I could't find anything with heavy googling. Therefore I hope you could  
help me here:

Imagine the following data:

{ timestamp: 123, id: abcd },  
{ timestamp: 234, id: abcd },  
{ timestamp: 543, id: abcd }  
{ timestamp: 673, id: abcd }

I want to calculate the session length from this data in elastic search /  
kibana. A session is continuous, if the timestamp interval between two  
ordered entries is e.g. smaller than 200. According to the above data, two  
sessions should be created:

1: 234-123 = 111 \< 200 | session 1, duration 111  
2: 543-234 = 311 \> 200 | session 2, duration ...  
3: 673-543 = 130 \< 200 | session 2, duration 130

How can I achieve that in elastic search?

Thanks in advance.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0ad8a0ca-4f60-4c52-ba7e-497099325d7b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0ad8a0ca-4f60-4c52-ba7e-497099325d7b%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:31am UTC](https://discuss.elastic.co/t/interval-between-timestamps-duration-of-session/22309/2 "2017-07-06T00:31:02Z")

</div>