# Scripted Fields Date Math **URL:** \ **Category:** Kibana\ **Created:** [November 28, 2018, 8:39pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649 "2018-11-28T20:39:25Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 28, 2018, 8:39pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/1 "2018-11-28T20:39:25Z")
I'd like to perform date math in a scripted field. The only two languages available are Painless and Expressions. Want to calculate the duration between a date field and current date/time. Here is what I have, it doesn't work and gives a compilation error. LocalDateTime.now().value- doc['@timestamp'].value Can someone suggest a workaround for this? Thank you ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 28, 2018, 10:09pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/2 "2018-11-28T22:09:16Z")
> [@kb2295](#): > > LocalDateTime.now().value Painless intentionally doesn't expose .now() style methods per [Groovy to Painless; get current date time](https://discuss.elastic.co/t/groovy-to-painless-get-current-date-time/95471) You can get the milliseconds of the document's @timestamp field using the following `doc['@timestamp'].value.getMillis()` ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 28, 2018, 10:12pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/3 "2018-11-28T22:12:02Z")
Just to be clear, that will give me the number of miliseconds passed since the timestamp? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 28, 2018, 11:26pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/4 "2018-11-28T23:26:38Z")
No, it won't. `doc['@timestamp'].value.getMillis()` gives you the absolute number of milliseconds that the document's `@timestamp` field is past the epoch. Painless intentionally doesn't exist .now() style methods and recommends alternate approaches since the clocks on the various Elasticsearch nodes are potentially out of sync and occur during various times, so this likely isn't what you want to do. ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 3:31pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/5 "2018-11-29T15:31:58Z")
So is there any way of calculating how much time has passed since a timestamp? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 3:59pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/6 "2018-11-29T15:59:43Z")
@kb2295 if you were using ES directly, you could pass the current datetime as a parameter to the script so we had a consistent thing to compare against, but this isn't really feasible in the context of Kibana since we don't support that. Would you mind elaborating on the end-result that you're trying to achieve in the context of Kibana? ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 4:51pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/7 "2018-11-29T16:51:23Z")
I have a field in each doc called "lastUpdated" this is a time field that captures the time the specified doc was updated. I need to see how long it's been in real time since the doc was updated. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 5:32pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/8 "2018-11-29T17:32:09Z")
Are you trying to create a chart/graph using this information, or just display it in a tabular format? ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 7:17pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/9 "2018-11-29T19:17:01Z")
I'm trying to make a chart from it. A chart which would tell me X documents were last updated less than 30 minutes ago, Y documents were updates less than 60 mins ago... ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 7:37pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/10 "2018-11-29T19:37:36Z")
You can do this using the Filters aggregation like the following: ![08%20AM](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a0156eea799ce01d61046ac43cc84b6d21776b8.png) ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 7:43pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/11 "2018-11-29T19:43:29Z")
So when I replace @timestamp with the name of the field, "lastUpdatedBy" it doesn't work? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 7:54pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/12 "2018-11-29T19:54:44Z")
If it's a number type, no it won't. It has to be a date if you want to do date math on it. ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 8:16pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/13 "2018-11-29T20:16:03Z")
It is a Date type ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 8:30pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/14 "2018-11-29T20:30:12Z")
Then you'll have to use `lastUpdatedBy:[now-30m TO now]` and `lastUpdatedBy:[now-60m TO now-30m]` ---
**Author:** ![kb2295](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@kb2295](https://discuss.elastic.co/u/kb2295)\ **Post date:** [November 29, 2018, 8:32pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/15 "2018-11-29T20:32:58Z")
It works now. Thank you! Another question. Is there documentation on the syntax? I'm trying to figure our how to say "older than 60m" without specifying an upper bound ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 29, 2018, 9:02pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/16 "2018-11-29T21:02:07Z")
Awesome, there are docs for it, it's the [Lucene Query Syntax](https://www.elastic.co/guide/en/kibana/current/lucene-query.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2018, 9:02pm UTC](https://discuss.elastic.co/t/scripted-fields-date-math/158649/17 "2018-12-27T21:02:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.