# Timestamp difference calculation
**URL:** https://discuss.elastic.co/t/timestamp-difference-calculation/105866
**Category:** Logstash
**Created:** [October 31, 2017, 10:27am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866 "2017-10-31T10:27:16Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@paulk4633](https://discuss.elastic.co/u/paulk4633)
#### Post date: [October 31, 2017, 10:27am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/1 "2017-10-31T10:27:16Z")
Hello, I have a problem with the calculation of a time difference between two timestamps:
"time1" =\> "31/10/2017:10:18:19.928 +0200",
"time2" =\> "31/10/2017:10:19:00.190 +0200"
As a result I want to have a field in Logstash with the time difference.
The following code does not work:
grok {
break\_on\_match =\> false
match =\> ["timerest", "%{SPACE}%{YEAR:year2}/%{MONTHNUM:month2}/%{MONTHDAY:day2}%{SPACE}%{HOUR:hour2}:%{MINUTE:minute2}:%{SECOND:second2}%{GREEDYDATA:timerest2}"]
}
mutate {
add\_field =\> { "time2" =\> "%{day2}/%{month2}/%{year2}:%{hour2}:%{minute2}:%{second2} +0200" }
}
```
date {
match => ["time2", "dd/MM/yyyy:HH:mm:ss.SSS Z"]
```
}
```
mutate {
remove_field => ["year2", "month2", "day2", "hour2", "minute2", "second2", "timerest2"]
}
```
date {
match =\> ["[Time1]", "ISO8601"]
target =\> "[Time1]"
}
date {
match =\> ["[Time2]", "ISO8601"]
target =\> "[Time2]"
}
ruby {
init =\> "require 'time'"
code =\> "duration = (event.get('time2') - event.get('time1')) rescue nil; event.set('Log\_duration', duration); "
}
Thank you for your answers 🙂
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2017, 10:59am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/2 "2017-10-31T10:59:01Z")
Field names are case-sentitive. You're storing to `Time1` but reading from `time1` in your ruby filter.
---
### Author:  [@paulk4633](https://discuss.elastic.co/u/paulk4633)
#### Post date: [October 31, 2017, 12:41pm UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/3 "2017-10-31T12:41:26Z")
Hello,
Thank you, i changed the code:
mutate {
add\_field =\> { "time1" =\> "%{day1}/%{month1}/%{year1}:%{hour1}:%{minute1}:%{second1} +0200" }
}
```
date {
match => ["time1", "yyyy-MM-dd HH:mm:ss.SSS Z"]
}
mutate {
remove_field => ["year1", "month1", "day1", "hour1", "minute1", "second1"]
}
```
grok {
break\_on\_match =\> false
match =\> ["timerest", "%{SPACE}%{YEAR:year2}/%{MONTHNUM:month2}/%{MONTHDAY:day2}%{SPACE}%{HOUR:hour2}:%{MINUTE:minute2}:%{SECOND:second2}%{GREEDYDATA:timerest2}"]
}
mutate {
add\_field =\> { "time2" =\> "%{day2}/%{month2}/%{year2}:%{hour2}:%{minute2}:%{second2} +0200" }
}
```
date {
match => ["time2", "yyyy-MM-dd HH:mm:ss.SSS Z"]
```
}
```
mutate {
remove_field => ["year2", "month2", "day2", "hour2", "minute2", "second2", "timerest2"]
}
```
date {
match =\> ["[time1]", "ISO8601"]
target =\> "[time1]"
}
date {
match =\> ["[time2]", "ISO8601"]
target =\> "[time2]"
}
ruby {
init =\> "require 'time'"
code =\> "duration = (event.get('time2') - event.get('time1')) rescue nil; event.set('Log\_duration', duration); "
}
}
}
Now i get the following error:
{:timestamp=\>"2017-10-31T13:39:12.047000+0100", :message=\>"Failed parsing date from field", :field=\>"time1", :value=\>"31/10/2017:13:38:42.259 +0200", :exception=\>"Invalid format: "31/10/2017:13:38:42.259 +0200" is malformed at "/10/2017:13:38:42.259 +0200"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss.SSS Z", :config\_locale=\>"default=en\_US", :level=\>:warn}
{:timestamp=\>"2017-10-31T13:39:12.053000+0100", :message=\>"Failed parsing date from field", :field=\>"time2", :value=\>"31/10/2017:13:38:58.313 +0200", :exception=\>"Invalid format: "31/10/2017:13:38:58.313 +0200" is malformed at "/10/2017:13:38:58.313 +0200"", :config\_parsers=\>"yyyy-MM-dd HH:mm:ss.SSS Z", :config\_locale=\>"default=en\_US", :level=\>:warn}
{:timestamp=\>"2017-10-31T13:39:12.055000+0100", :message=\>"Failed parsing date from field", :field=\>"[time1]", :value=\>"31/10/2017:13:38:42.259 +0200", :exception=\>"Invalid format: "31/10/2017:13:38:42.259 +0200" is malformed at "/10/2017:13:38:42.259 +0200"", :config\_parsers=\>"ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}
{:timestamp=\>"2017-10-31T13:39:12.056000+0100", :message=\>"Failed parsing date from field", :field=\>"[time2]", :value=\>"31/10/2017:13:38:58.313 +0200", :exception=\>"Invalid format: "31/10/2017:13:38:58.313 +0200" is malformed at "/10/2017:13:38:58.313 +0200"", :config\_parsers=\>"ISO8601", :config\_locale=\>"default=en\_US", :level=\>:warn}
Any ideas?
Thank you,
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2017, 12:46pm UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/4 "2017-10-31T12:46:23Z")
The string "31/10/2017:13:38:42.259 +0200" clearly doesn't match the date pattern "yyyy-MM-dd HH:mm:ss.SSS Z".
---
### Author:  [@paulk4633](https://discuss.elastic.co/u/paulk4633)
#### Post date: [November 7, 2017, 10:28am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/5 "2017-11-07T10:28:57Z")
Thank you for your help - now it is working fine 🙂
Now i have the Duration in this Format:
"time1" =\> "2017-11-07T10:26:10.902Z",
"time2" =\> "2017-11-07T10:26:21.451Z",
"Log\_duration" =\> 10.549
How can I transform this into minutes?
Thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 8, 2017, 6:21am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/6 "2017-11-08T06:21:39Z")
> How can I transform this into minutes?
I believe you need to use a ruby filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 6, 2017, 6:22am UTC](https://discuss.elastic.co/t/timestamp-difference-calculation/105866/7 "2017-12-06T06:22:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.