Hi, helped a little, I forgot there is a formula in "Metric" diagram. There could be million records of logs as well as none, so I was looking for something like "least effort", that means no data parsing or scripting. I found out there is now() function and is possible to compare it with @timestamp.
The outcome is formula:
abs((now() - last_value(@timestamp) - 3600) / 1000)
where abs() can be omitted, 3600 is time zone shift (dirty solution) and / 1000 removes milliseconds.
Result is count of seconds, which can be freely marked or painted within the metric diagram.
