Thanks for your reply.
Yes, I am using Logstash and you are correct about the indices, but to do what you suggest I would need to know in advance what I am looking for before I ingest the data. I'm ingesting the data into Elasticsearch for analysis, so I don't necessarily know what I'm looking for before I find an example.
There may be multiple instances where I want to display a cumulative time, and looking at one may give me cause to analyse another, but I can't re-ingest historical data via Logstash to find the duration of a different process.