# State Change for Alarms
**URL:** https://discuss.elastic.co/t/state-change-for-alarms/112403
**Category:** Kibana
**Created:** [December 19, 2017, 10:27am UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403 "2017-12-19T10:27:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)
#### Post date: [December 19, 2017, 10:27am UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403/1 "2017-12-19T10:27:31Z")
Hi,
I have a peculiar use case where we have multiple devices generating alarms of different nature.
I have Field Named: **Event** and the data looks like:
`date_time|alarm_type|device1|on`
corresponsing to that device i have another event
`date_time|alarm_type|device1|off`
Now i need to know how i can:
1. Identify the time taken for the alarm to reach from **on** to **off**
2. Provide a visualization to identify the Average time in alarm before acknowledgement or it went off.
3. Frequency of alarm\_type
Any help on the matter is highly appreciate.
---
### Author:  [@ppisljar](https://discuss.elastic.co/u/ppisljar)
#### Post date: [December 19, 2017, 1:57pm UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403/2 "2017-12-19T13:57:10Z")
First i would suggest to index your data in a way that each of the parts of your field `date_time|alarm_type|device1|off` is a separate field, so datetime field, alarm\_type field, device field and value/state field
also you can use [https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html)
to calculate the elapsed time you from `on` to `off` event.
once this is done calculating average time should be really straight forward (just use average aggregation on the elapsed field).
for calculating the frequency, what exactly would you expect to see there ? N alarms per hour or something like this ? that should be easy as well once alarm\_type is a separate field.
just do a date histogram with a fixed interval and use count as a metric.
then you could probably use `time series visual builder` and its `calculation` aggregation
---
### Author:  [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)
#### Post date: [December 20, 2017, 4:26am UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403/3 "2017-12-20T04:26:51Z")
@ppisljar
Hi Peter,
Thanks for providing me exactly what i was looking for, here are some more insights on the setup i have.
Yes, i have my data indexed with all the fields such as
- date\_time
- alarm\_type
- deviceid
- state
- unique\_id (corresponding to each device ID with alarm type)
Now like on and off i have multiple alarm states like
alarm & normal
open & closed
...
Based on the documentation for elapsed filter, should i be adding multiple tags to achieve what i intend to?
For the frequency, i need to know the frequency of a specific type of alarm and be able to further drill down.
For the rest i will let you know how it goes as per your brilliant suggestions.
Thanks again.
---
### Author:  [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)
#### Post date: [December 24, 2017, 7:17am UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403/4 "2017-12-24T07:17:37Z")
@ppisljar
Hi Peter,
I was successfully able to create the elapsed filter to get the **elapsed\_time** for my events with one issue
1. The timefield to look at for calculating elapsed\_time? ,since i have multiple timestamp fields.
2. There are some negative values in the **elapsed\_time** field which is generated.
3. How Add a field which stores some attributes like %{alarm\_type}%{unique\_id} ifnegative values are calculated for **elapsed\_time** field?
Again Thanks for your help.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 21, 2018, 7:18am UTC](https://discuss.elastic.co/t/state-change-for-alarms/112403/5 "2018-01-21T07:18:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.