Plot latency measure based on two time fields in an index

[Ramdev_Wudali]

Hi All:
I am not sure if this has been asked and answered (my searches have not returned results for this), So here goes :

I have an index with a timestamp of when a document was persisted to the index as well as a timestamp of when the document was actually created. I would like to measure the latency as the difference between the two time stamps and then plot it in Kibana, each message has a unique identifier. Is this possible with Timelion or with the Vanilla Kibana. Any help is much appreciated.

Can this be done in logstash to introduce a new field as the difference between the two timestamps ??

Thanks

Ramdev

[thomasneirynck]

hi @Ramdev_Wudali

consider looking at scripted fields in Kibana (https://www.elastic.co/guide/en/kibana/current/scripted-fields.html). Use a Painless-script to get the difference in time-stamps.

To get started, use this tutorial https://www.elastic.co/blog/using-painless-kibana-scripted-fields on how to create scripted fields.

[Ramdev_Wudali]

I ended up using logstash with the filter plugin for ruby code to calculate the time difference and persist it as an additional field. The reason for not going with painless is that we are not at a version of Kibana (or ES i.e. ver. 5.0+) that will allow for painless scripted fields in Kibana.

Thanks