# Logstash filter duration calculation

**URL:** <https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035>\
**Category:** Logstash\
**Created:** [August 15, 2016, 3:35pm UTC](https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035 "2016-08-15T15:35:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yahoo](https://avatars.discourse-cdn.com/v4/letter/y/898d66/32.png) [@yahoo](https://discuss.elastic.co/u/yahoo)\
**Post date:** [August 15, 2016, 3:35pm UTC](https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035/1 "2016-08-15T15:35:56Z")

</div>

in my log, each log line has action start time and action end time formatted as HHmmss.  
I used the following code in the logstash filter.  
It works well if the action lasts during the same day.  
However, it runs into problems when the action end time passes midnight.  
For example: this action's duration is 5 minutes  
action start time 23:58:00  
action end time 00:03:00 (i.e. the next day)  
Then I get a wrong calculation (negative value).

I appreciate any help in solving this problem.

```
# get the duration of the action_time
     date {
            match => ["[action_start_time]", "HHmmss"]
            target => "[action_start_timed]"
            timezone => "America/New_York" 
       }
     date {
            match => ["[action_end_time]", "HHmmss"]
            target => "[action_end_timed]"
            timezone => "America/New_York" 
     }
     ruby {
            code => "event['action_duration'] = (event['action_end_timed'] - event['action_start_timed'])"
     }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 15, 2016, 8:27pm UTC](https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035/2 "2016-08-15T20:27:33Z")

</div>

How about changing the Ruby code to add 24 hours if the resulting duration is negative?

---

<div class="post-metadata">

**Author:** ![yahoo](https://avatars.discourse-cdn.com/v4/letter/y/898d66/32.png) [@yahoo](https://discuss.elastic.co/u/yahoo)\
**Post date:** [August 16, 2016, 8:15pm UTC](https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035/3 "2016-08-16T20:15:14Z")

</div>

I did that using

```
 ruby {
        code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
        code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"

```

}  
and ruby plugin gave me an error stating it was expecting a string.

then I separated them and it worked:

```
 ruby {
        code => "event['recording_duration'] = (event['recording_end_timed'] - event['recording_start_timed'])"
 }
 ruby {
       code => "if event['recording_duration'] < 0 then event['recording_duration'] = event['recording_duration'] + 86400 end"
 }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/logstash-filter-duration-calculation/58035/4 "2017-07-06T04:43:12Z")

</div>