# Subtract timestamps from logs basis a field and show as a view on dashboard

**URL:** https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116
**Category:** Kibana
**Created:** [September 10, 2022, 2:53pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116 "2022-09-10T14:53:37Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Murali\_Y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/murali_y/32/98137_2.png) [@Murali\_Y](https://discuss.elastic.co/u/Murali_Y)
#### Post date: [September 10, 2022, 2:53pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116/1 "2022-09-10T14:53:37Z")

</div>

Hello all,  
My logs are having below 2 entries:

@timestamp:Sep 10, 2022 @ 20:11:42.677 fingerprint:2222-605819443b6 Item\_Name:069931601477 jobId:4444-ff-4555 level:Info levelOrdinal:2 logF\_BusinessProcessName:Test logType:User machineId:111 machineName:hostname1 message:test | ProcessCode : 10000 rawMessage:{"message":"test| ProcessCode : 10000","level":"Information","logType":"User","timeStamp":"2022-09-10T20:11:42.6778335+05:30"

@timestamp:Sep 10, 2022 @ 20:11:46.531 fingerprint:2322-44444444 Item\_Name:069931601477 jobId:4444-ff-4555 level:Info levelOrdinal:2 logF\_BusinessProcessName:Test logType:User machineId:111 machineName:hostname1 message:test | ProcessCode : 10000 rawMessage:{"message":"test| ProcessCode : 10000","level":"Information","logType":"User","timeStamp":"2022-09-10T20:11:46.531895+05:30"

I need to subtract timestamps of above 2 entries based on the 'ProcessCode' field in seconds. And create view for it.

Please suggest. TIA.

Regards.

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 10, 2022, 7:25pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116/2 "2022-09-10T19:25:48Z")

</div>

Check [this](https://stackoverflow.com/questions/44125671/calculate-date-difference-in-logstash-based-on-conditional-text)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 8, 2022, 7:26pm UTC](https://discuss.elastic.co/t/subtract-timestamps-from-logs-basis-a-field-and-show-as-a-view-on-dashboard/314116/3 "2022-10-08T19:26:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.