# Show cumulative duration between start / stop events **URL:** \ **Category:** Kibana\ **Created:** [June 28, 2016, 7:52pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198 "2016-06-28T19:52:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Post date:** [June 28, 2016, 7:52pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/1 "2016-06-28T19:52:10Z")
Hello, I am logging firewall events and see a process start and stop throughout the day. I want to show for how much of the day the process was running, by the cumulative sum of: @timestamp (end\_event) - @timestamp (start\_event) Is this possible in Kibana? Thank you. ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 28, 2016, 8:07pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/2 "2016-06-28T20:07:21Z")
As you mentioned `@timestamp`, I'll assume you are using Logstash. Further, I'll assume your start and stop events are being stored in indices named `logstash-*` (where `*` is some time-based value) Then you do something like this in your Logstash pipeline: - When you encounter an end event, use the [elasticsearch filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html) to query the `logstash-*` indices for the corresponding start event document. - Grab the start time from that start event document and use the end time from the end event document currently being processed to compute the difference = process lifetime. - Add a field for the process lifetime in the end event document. Say this field is called `process_lifetime`. Then in Kibana you can visualize the end event documents, aggregating on the sum of `process_lifetime`. ---
**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Post date:** [June 28, 2016, 8:38pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/3 "2016-06-28T20:38:46Z")
Thanks for your reply. Yes, I am using Logstash and you are correct about the indices, but to do what you suggest I would need to know in advance what I am looking for before I ingest the data. I'm ingesting the data into Elasticsearch for analysis, so I don't necessarily know what I'm looking for before I find an example. There may be multiple instances where I want to display a cumulative time, and looking at one may give me cause to analyse another, but I can't re-ingest historical data via Logstash to find the duration of a different process. ---
**Author:** ![JuanCarniglia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juancarniglia/32/11154_2.png) [@JuanCarniglia](https://discuss.elastic.co/u/JuanCarniglia)\ **Post date:** [August 2, 2016, 3:57am UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/4 "2016-08-02T03:57:36Z")
Check out [Elapsed Filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html). It is just for this. I have used it, I can give you a hand. ---
**Author:** ![Geezer](https://avatars.discourse-cdn.com/v4/letter/g/49beb7/32.png) [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Post date:** [August 8, 2016, 9:35pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/5 "2016-08-08T21:35:04Z")
Thank you for your reply. I will take a look. I'm building a new cluster at the moment so will test this when it's up. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/show-cumulative-duration-between-start-stop-events/54198/6 "2017-07-06T13:41:37Z")