# Time between timestamp **URL:** \ **Category:** Logstash\ **Created:** [October 14, 2015, 5:38am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137 "2015-10-14T05:38:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Anmol\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Post date:** [October 14, 2015, 5:38am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/1 "2015-10-14T05:38:31Z")
I have a use case , logs are coming into logstash but due to some failure their is a time elapse between two timestamps for example each log has time period between it of 2 minutes and unexpectedly their is 10 minutes gap and again log are coming now i want to analyse that gap , maybe due to some JVM failure that time gap came so that starting timestamp will have that message of failure so i can analyse it . So is there a way in logstash that i can see that gap and analyse log having timestamp just before the gap came. Is there any filter plugin for it or we can perform arithmetic operation in logstash?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 14, 2015, 5:50am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/2 "2015-10-14T05:50:32Z")
Perhaps the [elapsed filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html) can help? ---
**Author:** ![Anmol\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Post date:** [October 14, 2015, 6:18am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/3 "2015-10-14T06:18:17Z")
can elapse tell time difference between each event in log? because i think it just tell time elapse between whole log running . can you give some example of it because i am not able to understand whats given in docs. should i specify task\_id there or something else. Can you tell me that please? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 14, 2015, 10:44am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/4 "2015-10-14T10:44:26Z")
The elapsed filter tracks the time between start/end events matching a particular pattern. Perhaps that pattern can be configured to match all messages and you get the time between each message? Otherwise I don't know. ---
**Author:** ![Anmol\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Post date:** [October 14, 2015, 10:46am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/5 "2015-10-14T10:46:40Z")
filter { grok { match =\> ["message", "%{TIMESTAMP\_ISO8601} START id: (?\.\*)"] add\_tag =\> ["taskStarted"] } } here at match is it right? can we write like this because i am getting \_grokparsefailure task\_id is field from my logs or i make new ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 14, 2015, 10:52am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/6 "2015-10-14T10:52:28Z")
I don't know what your messages look like so it's impossible to judge if the grok expression is correct. ---
**Author:** ![Anmol\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Post date:** [October 15, 2015, 8:31am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/7 "2015-10-15T08:31:48Z")
I just found out elapsed wont help me as it wont give difference of every timestamp in log file, is their any other way , script filter of elasticsearch or anything ?? i just need a way so that i can plot difference of timestamps in a bar chart , so that maximum difference will automatically show that something is weird in logs . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:26am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137/8 "2017-07-06T05:26:27Z")