# Trying to calculate differences between 2 timestamps
**URL:** https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443
**Category:** Logstash
**Created:** [July 24, 2020, 4:31am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443 "2020-07-24T04:31:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@windowsrefund\_refund](https://discuss.elastic.co/u/windowsrefund_refund)
#### Post date: [July 24, 2020, 4:31am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/1 "2020-07-24T04:31:35Z")
```auto
input {
generator {
message => "Jul 24 03:35:03 myhost metricbeat: 2020-07-24T03:35:03.788Z#011INFO#011[publisher]#011pipeline/retry.go:225#011 done"
count => 1
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:event_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
}
# create a date object from our matched field above
date {
match => ["event_timestamp", "MMM dd HH:mm:ss"]
target => ["event_timestamp"]
}
math {
calculate => [
["sub", "[@timestamp]", [event_timestamp], "[lag]" ]
]
}
}
output { stdout { codec => rubydebug } }
```
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 24, 2020, 5:02am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/2 "2020-07-24T05:02:09Z")
I think it's always nice to ask an actual question in a post. Anyway, you can do that easily with a Ruby filter:
```auto
ruby {
code => 'event.set("lag", event.get("@timestamp")-event.get("event_timestamp"))'
}
```
---
### Author:  [@windowsrefund\_refund](https://discuss.elastic.co/u/windowsrefund_refund)
#### Post date: [July 24, 2020, 5:11am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/3 "2020-07-24T05:11:58Z")
Really not sure why you feel so entitled to tell others how to post (in a non-DRY fashion) but am grateful for your solution. I forgot all about the move to get and set methods.
Thank you.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 24, 2020, 5:18am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/4 "2020-07-24T05:18:05Z")
I didn't mean to sound entitled. I just tried to say that, if you want others to take time to help you, it would be nice if one opened the post and there was more than just a wall of code. Maybe even an explanation what you tried and what happened.
---
### Author:  [@windowsrefund\_refund](https://discuss.elastic.co/u/windowsrefund_refund)
#### Post date: [July 24, 2020, 5:19am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/5 "2020-07-24T05:19:27Z")
It's all good. Thanks for helping me out of a jam. I owe you a bagel.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 21, 2020, 5:19am UTC](https://discuss.elastic.co/t/trying-to-calculate-differences-between-2-timestamps/242443/6 "2020-08-21T05:19:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.