# Subtract term X from Y on the same log?

**URL:** https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782
**Category:** Logstash
**Created:** [September 17, 2017, 6:02am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782 "2017-09-17T06:02:42Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)
#### Post date: [September 17, 2017, 8:44am UTC](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782/2 "2017-09-17T08:44:34Z")

</div>

> [@tomer](#):
>
> event['delay'] = (event['old1']-event['old2'])

Found an answer here:

> [@Logstash Ruby filter to subtract difference between two timestamps in single event](https://discuss.elastic.co/t/logstash-ruby-filter-to-subtract-difference-between-two-timestamps-in-single-event/32580):
>
> Hi, I'm trying to demonstrate the feasability of switching from a Splunk solution to an ELK (Elasticsearch, Logstash and Kibana) stack (with Redis) solution for log analysis and triggering alerts. I have a requirement (due to a legacy application on a system with performace issues which is not the ELK stack server) to add a field at the time of indexing to events that shows the difference between two timestamps from the the same event (so I can't use the logstash elapsed filter plugin as that …

```
filter {
  if [received_at] and [@timestamp] {
    ruby {
      init => "require 'time'"
      code => "
        received_by_indexer = Time.iso8601(event['received_at'].to_s).to_i;
        time_in_event = Time.iso8601(event['@timestamp'].to_s).to_i;
        event['time_difference_in_seconds'] = received_by_indexer - time_in_event;
        event['epoch_received_at_in_seconds'] = received_by_indexer;
        event['epoch_timestamp_in_seconds'] = time_in_event;
        "
      add_tag => ["calculated_time_difference"]
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/subtract-term-x-from-y-on-the-same-log/100782)._