Should something like this work?
doc['timestamp'].value - doc['data.LOGON_TIME'].value;
I've tried numerous variations. Setting variables. using a return statement.
I basically just need to know how many milliseconds or seconds between these 2 fields.
I get this message in Discover:
Courier Fetch: 5 of 25 shards failed.
1 Like
weltenwort
(Felix Stürmer)
December 5, 2017, 12:36pm
2
Hi @BrianBeaulieu ,
you should be able to access the millisecond values as long
s using doc['timestamp'].value.millis
and doc['data.LOGON_TIME'].value.millis
respectively.
2 Likes
system
(system)
Closed
January 2, 2018, 12:37pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.