# Subtract term X from Y on the same log?
**URL:** https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782
**Category:** Logstash
**Created:** [September 17, 2017, 6:02am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782 "2017-09-17T06:02:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@tomer](https://discuss.elastic.co/u/tomer)
#### Post date: [September 17, 2017, 6:02am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782/1 "2017-09-17T06:02:42Z")
How can I Subtract term X from Y on the same log?
I saw [this](https://discuss.elastic.co/t/want-to-combine-field-values-into-new-field-value/28564/5), but it doesn't do any arithmetical use. (This uses mutate).
I also tried through a scripted field in Kibana but the fields are not saved in ES and I need to later use them.
P.S.
I also tried through the ruby filter:
> ```
> event['delay'] = (event['old1']-event['old2'])
>
> ```
but it didnt result with any thing
Help will be greatly appreciated.
---
### Author:  [@tomer](https://discuss.elastic.co/u/tomer)
#### Post date: [September 17, 2017, 8:44am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782/2 "2017-09-17T08:44:34Z")
> [@tomer](#):
>
> event['delay'] = (event['old1']-event['old2'])
Found an answer here:
> [@Logstash Ruby filter to subtract difference between two timestamps in single event](https://discuss.elastic.co/t/logstash-ruby-filter-to-subtract-difference-between-two-timestamps-in-single-event/32580):
>
> Hi, I'm trying to demonstrate the feasability of switching from a Splunk solution to an ELK (Elasticsearch, Logstash and Kibana) stack (with Redis) solution for log analysis and triggering alerts. I have a requirement (due to a legacy application on a system with performace issues which is not the ELK stack server) to add a field at the time of indexing to events that shows the difference between two timestamps from the the same event (so I can't use the logstash elapsed filter plugin as that …
```
filter {
if [received_at] and [@timestamp] {
ruby {
init => "require 'time'"
code => "
received_by_indexer = Time.iso8601(event['received_at'].to_s).to_i;
time_in_event = Time.iso8601(event['@timestamp'].to_s).to_i;
event['time_difference_in_seconds'] = received_by_indexer - time_in_event;
event['epoch_received_at_in_seconds'] = received_by_indexer;
event['epoch_timestamp_in_seconds'] = time_in_event;
"
add_tag => ["calculated_time_difference"]
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2017, 8:44am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782/3 "2017-10-15T08:44:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.