Time Duration difference calculation in Logstash

Hi All,
i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc


"opentime" : "2020-11-01T11:42:59.000Z",
"resolvedtime" : "2020-11-02T22:38:37.000Z",


filter {
date {
     match => ["opentime", "ISO8601"]
date {
     match => ["resolvedtime", "ISO8601"]

ruby {
     init => "require 'time'"
     code => "duration = (event.get('resolvedtime') - event.get('opentime')) rescue nil; event.set('Time_duration', duration); "

Time_duration: null

Thanks in Advance


Could you try this please

event.set('duration', event.get('resolvedtime').to_i - event.get('opentime').to_i);

That will set [@timestamp]. You should use

date { match => ["opentime", "ISO8601"] target => "opentime" }

to overwrite [opentime]. Similarly for [resolvedtime]. Then use .to_i as ParashB pointed out.

Thanks @Badger and @ParashB . It is working

Hi @Badger & @ParashB

Now i'm getting in epoch time, is there any way to convert the duration in time format. e.g. hh:mm:ss

So Output would be like below

I hope this would be helpful for you

Convert Elapsed Time to Duration


I'm using Logstash & Elasticsearch and integrating with Grafana. Not using kibana, the above link is using kibana scripted value. I want to convert into date format (HH:MM:SS) in logstash before sending the data to elastic.


Use a ruby filter and strftime.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.