Using painless to calculate durations

This question looks like another case of "joining related records based on a high cardinality ID"

See How to search relationship between log lines

1 Like