I have several different indices grabbing events that have definitive start and stop points (I have an eventKey field that says "started" or "ended"). Each field also has a unique eventId field so that all things that happen in a given event have the same ID. Is there a way via painless where if t…

This question looks like another case of "joining related records based on a high cardinality ID" See How to search relationship between log lines

Discuss the Elastic Stack

Using painless to calculate durations

Elastic Stack Elasticsearch

Mark_Harwood (Mark Harwood) February 14, 2018, 4:04pm 18

One for the logstash forums I expect.

Topic		Replies	Views
Elapsed time calculation between different events Elasticsearch	2	3789	July 9, 2019
Start and stop events in logfiles Elasticsearch	3	889	July 5, 2017
Finding time difference between two events with in a single batch of logstash Elasticsearch	6	1052	October 7, 2019
Show cumulative duration between start / stop events Kibana	5	7760	July 6, 2017
Logstash - Elasticsearch filter unable to fetch start events Logstash	1	476	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Using painless to calculate durations

Related topics