# Time elapsed between two events with EQL (and then use that in a visualization)
**URL:** https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355
**Category:** Elasticsearch
**Tags:** runtime-fields, eql-elastic-query-language
**Created:** [December 17, 2021, 6:09pm UTC](https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355 "2021-12-17T18:09:32Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@syunusic](https://discuss.elastic.co/u/syunusic)
#### Post date: [December 17, 2021, 6:09pm UTC](https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355/1 "2021-12-17T18:09:32Z")
I have this log that has three relevant fields:
- @timestamp
- EVENTNO (Event number)
- DEVICEID (Device ID)
I want to know how much time happens between the start and the end of something specific (start of that something: EVENTNO="300095", end of it: EVENTNO="300096"), so I created this EQL search:
```auto
GET /redbanc-proview/_eql/search
{
"query": """
sequence by DEVICEID with maxspan=3h
[any where EVENTNO == "300095"]
[any where EVENTNO == "300096"]
""",
"fields": [
{
"field": "@timestamp",
"format": "epoch_millis"
}
]
}
```
As result I got what I want: When a certain event starts (that's the one with EVENTNO 300095) and when it ends (EVENTNO 300096), great.
Now, I need how much time is between two events.
I transformed @timestamp into epoch\_millis hoping that helps in the next step: subtract both @timestamp. I know EQL has subtract, so I was thinking soething like:
```auto
"runtime_mappings": {
"amount_of_time": {
"type": "time",
"script": "subtract(emit(doc['@timestamp'].value.event2,emit(doc['@timestamp'].value.event1)"
}
},
```
Of course this runtime mapping is totally made up, but is to get the idea.
Any ideas on how to do it?
And then, supposing I get that time... how could I put that into a visualization?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 14, 2022, 6:10pm UTC](https://discuss.elastic.co/t/time-elapsed-between-two-events-with-eql-and-then-use-that-in-a-visualization/292355/2 "2022-01-14T18:10:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.