Script Field in Kibana with Time Passed Since Timestamp

Elastic Stack Kibana
1

Hi Experts,

I did quite an extensive search (Google and this forum) but to my surprise couldn't find anything.
If I just asked the question the wring way please point me to the right thread or something.

What I wanted to do is to have a script field in Kibana (v4) showing me the time passed since the time indicated in a timestamp field of document. While I know how to handle timestamp values I couldn't figure out how to get the 'Now' timestamp to calculate the time passed since.

To provide some context: I'm tracking state changes of jobs by parsing log files. Each time the state of a job changes I update the according ES document with a matching timestamp (e.g. queued, active, done).

Now what I want is a data table showing me the e.g. the 10 events which are the longest in each state. I'd like to do this as it should allow to spot "hanging" events very easily, as they will bubble to the top of the table very soon (as my execution times are usually very similar).

Any help is very much appreciated.

Cheers and have a good weekend,
Ralph

1 Like
2

The default language in scripted fields is Lucene expressions, which at this time does not handle date math. We are working on another scripting language that will do that, but it's still ways away. For now, you can specify and use Groovy in your scripted fields, but for that you'd need to enable dynamic sandboxing (which has vulnerabilities) or use static Groovy scripts.

3

Hi Tanya,

thanks for responding. I'm not quite sure if we are talking about the same
thing here. The date math functionality is good enough for me i.e.
calculating the time delta of two timestamps works. Only thing I'm missing
is the 'now' time, by which I mean the time the query is executed.

When I do this programmatically, everything's fine because I know 'now' and
can calculate the delta, only in Kibana visualisations I don't know how to
get it. Is it maybe possible to get some sort of 'virtual field'
representing 'now' in the ES results? Then Kibana would be sufficient again.

Cheers,
Ralph

1 Like