# Logs Timestamp
**URL:** https://discuss.elastic.co/t/logs-timestamp/186207
**Category:** Kibana
**Created:** [June 18, 2019, 9:04am UTC](https://discuss.elastic.co/t/logs-timestamp/186207 "2019-06-18T09:04:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@PritiS](https://discuss.elastic.co/u/PritiS)
#### Post date: [June 18, 2019, 9:04am UTC](https://discuss.elastic.co/t/logs-timestamp/186207/1 "2019-06-18T09:04:19Z")
Hi ,
I am trying to fetch total timings taken by a Job from Status A to Status B from logs, extracted Log timestamp column,status, jobid from logs in Kibana, How can we extract the total time taken by the Job ID and visualize this in Kibana graph,
Can you please provide support..
Thank you,
Priti
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [June 24, 2019, 5:19pm UTC](https://discuss.elastic.co/t/logs-timestamp/186207/2 "2019-06-24T17:19:51Z")
Hi Priti,
This is actually rather difficult to do in Kibana. One way is by getting the data into an entity-centric index in Elasticsearch. What this means is that instead of having a time-based index where each event is indexed into Elasticsearch you would have one document per JobID and those documents would get updated with the time for each status and duration.
> [@Calculate time difference between two different record timestamps](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-record-timestamps/136545):
>
> So I am logging a bunch of logs of a big and mediumly complex workflow. This workflow is a graph and can take different paths based on the inputs or a particular workflow step's output. When the workflow is created a workflow id is generated, and is logged with the timestamp. Now I am taksed with calculating the average time it takes for the workflow to reach a workflow step X. What is the best way to achieve this? In my research so far, I have come across elapsed filter and this suggestion o…
Here's the only "solution" I know of that could work directly in Kibana using Advanced JSON field in a Kibana visualization. But if you have a large index, the performance could be a problem;
> [@Display concurrency in data on Kibana](https://discuss.elastic.co/t/display-concurrency-in-data-on-kibana/26006/3):
>
> You can actually do this if you query Elasticsearch directly by using a script on a date\_histogram aggregation which adds the call document to all the buckets from the start\_time to start\_time + duration. The following gist contains a Sense recreation that details what I mean: [https://gist.github.com/jpountz/cebb8452648c36099cee](https://gist.github.com/jpountz/cebb8452648c36099cee) As for doing this in Kibana, I know it's possible to run scripts in Kibana for some actions but I'm not sure if this would be possible, maybe someone more familiar with…
Related links;
> [@Calculate the time difference between consecutive documents](https://discuss.elastic.co/t/calculate-the-time-difference-between-consecutive-documents/128282/14):
>
> HI @MariumHassan this is my script input { elasticsearch { hosts =\> "http://192.168.55.213:9200" index =\> "test\_index" } } filter { aggregate { task\_id =\> "%{logTimestamp}" code =\> " map['logTimestamp'] = event.get('logTimestamp'); map['timeDifference']= (Time.parse(event.get('logTimestamp')).to\_f - Time.parse(map['previousTime']).to\_f).round(4); map['previousTime'] = event.get('logTimestamp'); " } } output { elasticsearch { document\_id =\> "%{logTimestamp}" document\_typ…
> [@How to calculate time difference between 2 log lines for a unique ID](https://discuss.elastic.co/t/how-to-calculate-time-difference-between-2-log-lines-for-a-unique-id/155870):
>
> I need to calculate the difference in time between 2 log lines for http code 200. The difference should be done for a unique id. Please find the log line below. 2018/01/16 00:13:44.890 [HCServiceImpl] [\*\*qtp5720769-243\*\*]: AUDIT- INFO: Request received : /mdp/content?sourceType=cid&pset=mdp%3Ano-presentation&filter%3AcontentId=cid%3A%2F%2Fprogramid%253A%252F%252F2090543776%23programid%253A%252F%252F1264605229 2018/01/16 00:13:44.897 [HCServiceImpl] [\*\*qtp5720769-243\*\*]: AUDIT- INFO:…
> [@Calculate time difference between two logs with uniqueid](https://discuss.elastic.co/t/calculate-time-difference-between-two-logs-with-uniqueid/149041):
>
> hi there is there anyway to calculate time difference between two logs with uniqueid? eg i create fields log\_timestamp, log\_type, user\_id, mobile\_no, etc., below logs 2018-09-19 09:24:57,113 (null) 21 WARN : Test :: vh1o4ctmdpn3aft53o5nx0nh :: User Req : \\9.7\\458458000000018\\2C10000299\\123456\\123456\\\\ 2018-09-19 09:24:57,453 (null) 21 WARN : Test :: vh1o4ctmdpn3aft53o5n…
---
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [June 25, 2019, 8:47am UTC](https://discuss.elastic.co/t/logs-timestamp/186207/3 "2019-06-25T08:47:47Z")
Hi PritiS
Do you use logstash and realtime log shipping? If so, lucky you.
I solved by using logstash `grok filter` and `elapsed filter`.
For instance, let me share how to do
- make start point for Status A log
- make end point for Status B log
- then connect start point and end point using by unique id (eg: jobid)
> if "StatusA" in [message] {
> grok {
> match =\> { "message" =\> ["grok pattern for your StatusALog. Let's say you will get status, jobid"]}
> add\_field =\> { "log\_type" =\> "StatusA" }
> add\_tag =\> ["status\_a"]
> }
> }
>
> else if "StatusB" in [message] {
> grok {
> match =\> { "message" =\> ["grok pattern for your StatusBLog. Let's say you will get status, jobid"]}
> add\_field =\> { "log\_type" =\> "StatusB" }
> add\_tag =\> ["status\_b"]
> }
> }
>
> elapsed {
> start\_tag =\> "status\_a"
> end\_tag =\> "status\_b"
> unique\_id\_field =\> "jobid"
> periodic\_flush =\> true
> timeout =\> 2100
> }
You will see elapsed\_time, elapsed\_timestamp\_start fields at StatusB log in kibana. `elapsed_time` is different timestamp of StatusA and StatusB. `elapsed_time` field is float type. It's cool.
Then visualize it. I use TimeLion visualization. Here is my sample.
Y-axis : elapsed\_time (in sec)
X-axis : time
But plz note that elapsed\_time values are only accurate at same CPU.
If pipeline.workers: 1, the result will accurate.
If pipeline.workers: 2, the result won't accurate.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 23, 2019, 8:47am UTC](https://discuss.elastic.co/t/logs-timestamp/186207/4 "2019-07-23T08:47:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.