# Logstash-Elapsed Filter

**URL:** <https://discuss.elastic.co/t/logstash-elapsed-filter/150569>\
**Category:** Logstash\
**Created:** [October 1, 2018, 1:05pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter/150569 "2018-10-01T13:05:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sudharsan\_Ganesh](https://avatars.discourse-cdn.com/v4/letter/s/e8c25b/32.png) [@Sudharsan\_Ganesh](https://discuss.elastic.co/u/Sudharsan_Ganesh)\
**Post date:** [October 1, 2018, 1:05pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter/150569/1 "2018-10-01T13:05:22Z")

</div>

User Name is not coming, its coming as %{usr} when viewed in Kibana. Here George is the Username. Please let me know what should I do. My requirement is to display jobid, elapsedtime and username in kibana. Thanks in advance!.

Log:

## 2018-09-27 09:27:18,615 71e02f2f-32d5-9509-870a-f80e54dc8775 George Started 2018-09-27 09:29:14,615 71e02f2f-32d5-9509-870a-f80e54dc8775 George Complete

filter {  
grok {  
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{UUID:messageId} %{USERNAME:usr} %{WORD:event}"]  
add\_tag =\> ["%{event}"]  
}  
date {  
match =\> ["timestamp", "ISO8601"]  
}

elapsed {  
unique\_id\_field =\> "messageId"  
start\_tag =\> "Started"  
end\_tag =\> "Complete"  
new\_event\_on\_match =\> true  
add\_tag =\> ["%{messageId}"]  
add\_field =\> { "User" =\> "%{usr}"}  
}

if "%{messageId}" in [tags] {  
aggregate {  
task\_id =\> "%{messageId}"  
code =\> "map['report'] = [(event['elapsed\_time']\*1000).to\_i]"  
map\_action =\> "create"  
add\_field =\> { "User" =\> "%{usr}"}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2018, 1:05pm UTC](https://discuss.elastic.co/t/logstash-elapsed-filter/150569/2 "2018-10-29T13:05:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.