# Painless script fields: How to get date.start date.end for a http\_status=!200 **URL:** \ **Category:** Elasticsearch\ **Created:** [November 7, 2017, 10:04am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664 "2017-11-07T10:04:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [November 7, 2017, 10:04am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/1 "2017-11-07T10:04:34Z")
I want to create a new field that counts the downtime of my website, so if http\_status is different then 200; I need a total variable containing the difference between [@timestamp]date.start and [@timestamp]date.end. So is there any way to get those two dates? here's my idea: ``` if (doc['http_status'].value!=200) { total+=(doc['@timestamp'].date.minuteOfHour.start - doc['@timestamp'].date.minuteOfHour.end); return total; } ``` ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [November 7, 2017, 5:20pm UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/2 "2017-11-07T17:20:49Z")
Not sure life is that simple. 404s aren't 200s but don't mean a site is down. If your site is heading down there'll be slower response times. If your site is down-down there'll be no logs You could look at using Watcher to alert on deviations from traffic levels you define as "normal" (see [https://www.elastic.co/guide/en/x-pack/current/watcher-getting-started.html](https://www.elastic.co/guide/en/x-pack/current/watcher-getting-started.html)) If you want a solution to automatically learn what is "normal" then see [https://www.elastic.co/products/x-pack/machine-learning](https://www.elastic.co/products/x-pack/machine-learning) ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [November 8, 2017, 8:03am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/3 "2017-11-08T08:03:27Z")
Thanks for the information, but as I said I want to have a field "total" where I have the difference between [@timestamp]date.start and [@timestamp]date.end - this scripted field is just one step of my idea. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 8, 2017, 8:11am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/4 "2017-11-08T08:11:47Z")
Scripted fields are strictly per document, and it looks like you calculation wants to compare timestamps from different events (as each event tends to have a single timestamp). I therefore do not think what you want to do can be done through scripted fields. ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [November 8, 2017, 8:18am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/5 "2017-11-08T08:18:37Z")
Alright so what I want to do is having the total variable which is always incremented when we have a http\_status =! 200 for a precise URL, so at the end of each month I have this "total" variable containing the time where my website was not reachable. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 8, 2017, 8:21am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/6 "2017-11-08T08:21:19Z")
As mark explained, that may be misleading. If you are looking to monitor uptime, why not instead do this through [Heartbeat](https://www.elastic.co/products/beats/heartbeat)? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [November 8, 2017, 8:30am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/7 "2017-11-08T08:30:19Z")
Yeah I got the point but I don't want to have something running on the website server, so I have a script checking the URI and pushing the following data into elastic: ``` "properties": { "@timestamp": { "type": "date", "format" : "epoch_second" }, "uri": { "type": "keyword" }, "http_status": { "type": "integer" }, "response_time": { "type": "float" } } ``` Now based on these data I wanted to have a new scripted field to get the total I already explained, so if that's not possible with scripted fields is there another solution from this point to get the "total" variable that I want to report? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 8, 2017, 8:33am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/8 "2017-11-08T08:33:11Z")
If you know you're running this with a specific periodicity, you could perhaps add a field representing the time in seconds this measurement represent and aggregate across this? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [November 8, 2017, 8:44am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/9 "2017-11-08T08:44:02Z")
Yes indeed I can add this field in my script, it will take some time but it's possible - for now let's consider that I have a new field "failure" which contains in sec the time of each https\_status != 200, then a "total\_failure" could be scripted with scripted fields for each month or not? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 8, 2017, 8:47am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/10 "2017-11-08T08:47:03Z")
No, you would get this through an [aggregation query](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/search-aggregations.html), e.g. through a Kibana dashboard or directly using one of the language clients. Scripted fields are strictly for creating new, calculated fields per document. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/painless-script-fields-how-to-get-date-start-date-end-for-a-http-status-200/106664/11 "2017-12-06T08:47:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.