# Multiple Elapsed

**URL:** <https://discuss.elastic.co/t/multiple-elapsed/264459>\
**Category:** Logstash\
**Created:** [February 16, 2021, 5:13pm UTC](https://discuss.elastic.co/t/multiple-elapsed/264459 "2021-02-16T17:13:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![artobstrel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artobstrel/32/16874_2.png) [@artobstrel](https://discuss.elastic.co/u/artobstrel)\
**Post date:** [February 16, 2021, 5:13pm UTC](https://discuss.elastic.co/t/multiple-elapsed/264459/1 "2021-02-16T17:13:53Z")

</div>

I want to measure the duration of several events within a single transaction.  
I use a **elapsed** filter for this.

My data and logstash config file is below:

> **data file**
>
> ```
> 2021-02-16 16:00:00 016cbeb4 Input
> 2021-02-16 16:00:03 016cbeb4 Request
> 2021-02-16 16:00:08 016cbeb4 Response
> 
> ```

> **logstash conf**
>
> ```
> input {
> file {
> path => "/etc/logstash/data/test.log"
> start_position => "beginning"
> sincedb_path => "/dev/null"
> type => "elapsed_test"
> }
> }
> 
> filter {
> dissect {
> mapping => {
> "message" => '%{ts} %{id} %{operation}'
> }
> }
> 
> date {
> match => ["ts", "yyyy-MM-dd HH:mm:ss"]
> }
> 
> mutate {
> add_tag => "%{operation}"
> }
> 
> elapsed {
> start_tag => "Input"
> end_tag => "Response"
> unique_id_field => "id"
> new_event_on_match => false
> }
> }
> 
> output {
> elasticsearch {
> ...
> }
> }
> 
> ```

I get the duration between **Input** and **Response** (8 sec):

 ![elapsed1](https://us1.discourse-cdn.com/elastic/original/3X/6/5/653ee929e4a6d81139be7f1da9686343af08a4a2.png)

Please tell me how to additionally get the duration between **Input** and **Request** (3 sec)?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 16, 2021, 5:30pm UTC](https://discuss.elastic.co/t/multiple-elapsed/264459/2 "2021-02-16T17:30:30Z")

</div>

> [@artobstrel](#):
>
> Please tell me how to additionally get the duration between **Input** and **Request** (3 sec)?

Use a second elapsed filter.

---

<div class="post-metadata">

**Author:** ![artobstrel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artobstrel/32/16874_2.png) [@artobstrel](https://discuss.elastic.co/u/artobstrel)\
**Post date:** [February 17, 2021, 10:05am UTC](https://discuss.elastic.co/t/multiple-elapsed/264459/4 "2021-02-17T10:05:11Z")

</div>

I did it!  
Thank you @Badger

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/217e37bd7725a9308fc2aff3b609d863fa5fe407.png)

> **Final Logstash conf file:**
>
> ```
> input {
> file {
> path => "/etc/logstash/conf.d/data/elapsed_test.log"
> start_position => "beginning"
> sincedb_path => "/dev/null"
> type => "elapsed_test"
> }
> }
> 
> filter {
> dissect {
> mapping => {
> "message" => '%{ts}	%{id}	%{operation}'
> }
> }
> 
> date {
> match => ["ts", "yyyy-MM-dd HH:mm:ss"]
> }
> 
> mutate { 
> add_tag => "%{operation}"
> } 
> 
> elapsed {
> start_tag => "Input"
> end_tag => "Request"
> unique_id_field => "id"
> }
> 
> if [operation] == "Request" {
> mutate {
> copy => { "elapsed_time" => "Input-Request" }
> }
> }
> 
> elapsed {
> start_tag => "Input"
> end_tag => "Response"
> unique_id_field => "id"
> }
> 
> if [operation] == "Response" {
> mutate {
> copy => { "elapsed_time" => "Input-Response" }
> }
> }
> 
> elapsed {
> start_tag => "Request"
> end_tag => "Response"
> unique_id_field => "id"
> }
> 
> if [operation] == "Response" {
> mutate {
> copy => { "elapsed_time" => "Request-Response" }
> }
> }
> }
> 
> output {
> stdout {
> codec => rubydebug
> }
> 
> elasticsearch {
> hosts => ["http://<host>:9200"]
> index => "%{type}"
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2021, 10:06am UTC](https://discuss.elastic.co/t/multiple-elapsed/264459/5 "2021-03-17T10:06:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.