Time difference

Elastic Stack Elasticsearch
1

I have 2 documents and each document fields are as follow:

Timestamp / ID / Field

2021-06-15 12:00:00 / 1 / Start (doc1)
2021-06-15 12:00:05 / 1 / End (doc2)

How do I get a time difference between Start and End with ID=1 in the Dev Tools ?

I can do two SQL transactions to grab both start and end timestamp and compute the difference but this operation is not efficient if I do it for thousands of documents.

Thanks in advance.

2

You might want to take a look at transforms in order to create summary indices that contain exactly the data you need in a single document in order to create concise and fast queries.

hope this helps!

3

Thank you for your reply.

I created a transform and selected a grouping by ID.
In the aggregations fields, I selected Timestamp max and Timestamp min .

Timestamp / ID / Field

2021-06-15 12:00:00 / 1 / Start
2021-06-15 12:00:05 / 1 / Running
2021-06-16 1:00:01 / 1 / End

In this particular example, Timestamp.max would give me a value of 1:00:01 (Field is End) and Timestamp.min would give me 12:00:00 (Field is Start).

How would I change my aggregation if i wanted Timestamp.max to be the value where Field is 'Running', ie 12:00:05 ?

Also, is there a way to add another colum called duration and compute the timestamp max - timestamp min during the transform ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.