# Plotting time diff based on uniq thread\_id and API
**URL:** https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157
**Category:** Kibana
**Created:** [February 13, 2020, 8:36am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157 "2020-02-13T08:36:56Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Paresh\_Gandhare](https://discuss.elastic.co/u/Paresh_Gandhare)
#### Post date: [February 13, 2020, 8:36am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/1 "2020-02-13T08:36:56Z")
i have a log file as below. Fields are indexed as [thread\_id] [API] [method] [timestamp] [GREEDYDATA] respectively.
describing more on first two lines ,
1st line --\> 1111 is the thread\_id for api=/API1 with init time (method=GET) as Feb 11 22:27:13 PST 2020 and
2nd line ---\> Response to first line (method=RESP) with response timestamp as Wed Feb 11 22:27:15 PST 2020
my requirement is to calculate time diff (GET timestamp - RESP timestamp) for an API with unique thread id. Can someone please guide me on this.
```
1111 /API1 GET Wed Feb 11 22:27:13 PST 2020 XYZ
1111 /API1 RESP Wed Feb 11 22:27:15 PST 2020 status=200
1112 /API2 GET Wed Feb 11 22:28:13 PST 2020 XYZ
1112 /API2 RESP Wed Feb 11 22:28:15 PST 2020 status=200
1113 /API3 GET Wed Feb 11 22:29:13 PST 2020 XYZ
1113 /API3 RESP Wed Feb 11 22:30:15 PST 2020 status=200
```
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [February 13, 2020, 8:47am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/2 "2020-02-13T08:47:36Z")
hi Paresh,
You can try custom ruby code using ruby plugin , in logstash config.
Thanks
dilip
---
### Author:  [@Paresh\_Gandhare](https://discuss.elastic.co/u/Paresh_Gandhare)
#### Post date: [February 13, 2020, 8:55am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/3 "2020-02-13T08:55:36Z")
Thanks for the response Dilip,
you mean adding another event using logstash(and ruby) in ES ?
what will be the sample ruby code look like ?
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [February 13, 2020, 8:58am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/4 "2020-02-13T08:58:01Z")
hi Pranesh,
you can refer to the below for idea
> [@Add a new filed in csv based on a value in colum and cal the time diff](https://discuss.elastic.co/t/add-a-new-filed-in-csv-based-on-a-value-in-colum-and-cal-the-time-diff/196117):
>
> Hi all I have a set of csv data as below [image] i am interested in adding a new field 'status' based on the 'endtime' column value, i.e if its not 'null' then the status should be completed else open. also need to calculate the timedifference between 'endtime' and 'createtime' if the endtime value is not 'null' and then add a new field 'timetaken' can any one help me on this Thanks
Reagrds
dilip
---
### Author:  [@Paresh\_Gandhare](https://discuss.elastic.co/u/Paresh_Gandhare)
#### Post date: [February 13, 2020, 9:09am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/5 "2020-02-13T09:09:04Z")
in your case(and the original problem as well), start and end time was filtered and ingested in one go(and in one line). But in my case, these logs will be ingested live (app server logs), so at a given time, logstash will have access to only start time (API init call) and may be after 2-3 seconds it will have end time in another line. this make it very complex to calculate difference before ingesting to ES.
please correct me if i got it wrong. and if you have any solution which can work on already ingested data.
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [February 13, 2020, 10:08am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/6 "2020-02-13T10:08:38Z")
Hi Paresh
may be you can go with scripted fields in kibana, using painless script
Thanks
dilip
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2020, 10:08am UTC](https://discuss.elastic.co/t/plotting-time-diff-based-on-uniq-thread-id-and-api/219157/7 "2020-03-12T10:08:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.