# Problem with combining xmlfilter and ruby code to compute a time difference

**URL:** https://discuss.elastic.co/t/problem-with-combining-xmlfilter-and-ruby-code-to-compute-a-time-difference/195924
**Category:** Logstash
**Created:** [August 20, 2019, 12:16pm UTC](https://discuss.elastic.co/t/problem-with-combining-xmlfilter-and-ruby-code-to-compute-a-time-difference/195924 "2019-08-20T12:16:17Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 20, 2019, 12:55pm UTC](https://discuss.elastic.co/t/problem-with-combining-xmlfilter-and-ruby-code-to-compute-a-time-difference/195924/2 "2019-08-20T12:55:31Z")

</div>

There is no reason to use class or even instance variables here. You can use local variables. In fact, that might be the problem. If a message is missing one of req\_created or req\_ended it will use the value from the previous message. Personally I would use a date filter to parse the timestamps.

```
    date { match => ["req_created", "ISO8601"] target => "req_created" }
    date { match => ["req_ended", "ISO8601"] target => "req_ended" }
    ruby {
        code => '
            duration = 0.0
            ended = event.get("req_ended")
            created = event.get("req_created")
            if created and ended then
                duration = ended.to_f - created.to_f
            end
            event.set("req_duration_sec", duration)
        '
    }
```

---

_[View the full topic](https://discuss.elastic.co/t/problem-with-combining-xmlfilter-and-ruby-code-to-compute-a-time-difference/195924)._