# Time Duration difference calculation in Logstash

**URL:** <https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599>\
**Category:** Logstash\
**Created:** [February 8, 2021, 12:55pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599 "2021-02-08T12:55:31Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rebin](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@Rebin](https://discuss.elastic.co/u/Rebin)\
**Post date:** [February 8, 2021, 12:55pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/1 "2021-02-08T12:55:31Z")

</div>

Hi All,  
i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc

**Input**

```auto
"opentime" : "2020-11-01T11:42:59.000Z",
"resolvedtime" : "2020-11-02T22:38:37.000Z",

```

**Code**

```auto
filter {
date {
     match => ["opentime", "ISO8601"]
    }
date {
     match => ["resolvedtime", "ISO8601"]
      }

ruby {
     init => "require 'time'"
     code => "duration = (event.get('resolvedtime') - event.get('opentime')) rescue nil; event.set('Time_duration', duration); "
}
}

```

**Output**  
Time\_duration: null

Thanks in Advance

---

<div class="post-metadata">

**Author:** ![ParashB](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@ParashB](https://discuss.elastic.co/u/ParashB)\
**Post date:** [February 8, 2021, 3:21pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/2 "2021-02-08T15:21:38Z")

</div>

Hi,

Could you try this please

`event.set('duration', event.get('resolvedtime').to_i - event.get('opentime').to_i);`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 8, 2021, 5:36pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/3 "2021-02-08T17:36:20Z")

</div>

> [@Rebin](#):
>
> ```auto
> date {
> match => ["opentime", "ISO8601"]
> }
> 
> ```

That will set [@timestamp]. You should use

```
date { match => ["opentime", "ISO8601"] target => "opentime" }

```

to overwrite [opentime]. Similarly for [resolvedtime]. Then use .to\_i as ParashB pointed out.

---

<div class="post-metadata">

**Author:** ![Rebin](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@Rebin](https://discuss.elastic.co/u/Rebin)\
**Post date:** [February 9, 2021, 12:11pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/4 "2021-02-09T12:11:31Z")

</div>

Thanks @Badger and @ParashB . It is working

---

<div class="post-metadata">

**Author:** ![Rebin](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@Rebin](https://discuss.elastic.co/u/Rebin)\
**Post date:** [February 9, 2021, 12:44pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/5 "2021-02-09T12:44:13Z")

</div>

Hi @Badger & @ParashB

Now i'm getting in epoch time, is there any way to convert the duration in time format. e.g. hh:mm:ss

So Output would be like below  
**02:21:34**

---

<div class="post-metadata">

**Author:** ![ParashB](https://avatars.discourse-cdn.com/v4/letter/p/b2d939/32.png) [@ParashB](https://discuss.elastic.co/u/ParashB)\
**Post date:** [February 9, 2021, 2:35pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/6 "2021-02-09T14:35:21Z")

</div>

I hope this would be helpful for you

[Convert Elapsed Time to Duration](https://discuss.elastic.co/t/convert-number-elapsed-time-into-time-hhss/218551/3)

---

<div class="post-metadata">

**Author:** ![Rebin](https://avatars.discourse-cdn.com/v4/letter/r/b38774/32.png) [@Rebin](https://discuss.elastic.co/u/Rebin)\
**Post date:** [February 9, 2021, 4:49pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/7 "2021-02-09T16:49:19Z")

</div>

Hi,

I'm using Logstash & Elasticsearch and integrating with Grafana. Not using kibana, the above link is using kibana scripted value. I want to convert into date format (HH:MM:SS) in logstash before sending the data to elastic.

Regards,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/8 "2021-02-09T17:01:43Z")

</div>

Use a ruby filter and strftime.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2021, 5:02pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599/9 "2021-03-09T17:02:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.