# Scripted Field creation based on subtraction of time

**URL:** https://discuss.elastic.co/t/scripted-field-creation-based-on-subtraction-of-time/73667
**Category:** Kibana
**Created:** [February 2, 2017, 11:58am UTC](https://discuss.elastic.co/t/scripted-field-creation-based-on-subtraction-of-time/73667 "2017-02-02T11:58:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Prateek\_Kshtriya](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)
#### Post date: [February 2, 2017, 11:58am UTC](https://discuss.elastic.co/t/scripted-field-creation-based-on-subtraction-of-time/73667/1 "2017-02-02T11:58:42Z")

</div>

Hi All,  
Please suggest how to create the scripted field to have the difference of the time based on specific condition?

Problem statement- The message with unique message ID traverses to 4 states during batch execution  
There are four states indexed at different time stamp say State 1\>\>State 2\>\>State 3\>\>State 4 , so how to find elapsed time by doing @time\_State 4 -@time\_State 1 applying condition on unique message ID for message journey.

Regards,  
Prateek

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [February 2, 2017, 5:39pm UTC](https://discuss.elastic.co/t/scripted-field-creation-based-on-subtraction-of-time/73667/2 "2017-02-02T17:39:07Z")

</div>

What would you like the end result to look like? Milliseconds? A human readable string?

If you just want a number or millis or seconds, Lucene expressions would be a simple solution [https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-expression.html#\_date\_field\_api](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-expression.html#_date_field_api)

If you'd like to produce a human readable string, [Painless](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-painless-syntax.html) should provide the flexibility you need. There's a great blog post with some date math examples that should help get you started [https://www.elastic.co/blog/using-painless-kibana-scripted-fields](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2017, 5:39pm UTC](https://discuss.elastic.co/t/scripted-field-creation-based-on-subtraction-of-time/73667/3 "2017-03-02T17:39:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
