Visualization to view the difference of time for two events with a particular field value

[kaushik.vankayala]

Hi There,

I am a total newbie to the ELK stack. I have recently developed a logstash pipeline successfully for a custom log of an application and now i have the data on elasticsearch and indexed in kibana as expected. Now i have great challenge with creating a visualization for some data. The use-case is explained as below, please help if you can.

FYI : The log structure and the issues faced in stashing are listed out here.

Now, for those who are interested in just assisting with my issue;

I have events with a field type having value as Audit-IN and Audit-OUT in my index on a highlevel view. They have some similar fields and some different. Now there is a timehit field in both of the events and a field named as transactionid which will have the same value for both types. At any time, for a particular transactionid the Audit-IN will be the first and then follows the Audit-OUT with respect to time.

My use-case is to visualize all the transaction IDs are some selected ones and find the difference between the time stamps.

I am confused as to what type of visualization to be used and how to configure it.

The view of a Audit-IN document in kibana is as follows;

The view of a Audit-OUT document in kibana is as follows;

As per the above screen shot and the fields marked in green,
The time taken between the Audit-IN and Audit-OUT of the transactionid (0e90862318794eb587ed93ef800cf62d) is 359 ms.

Thanks & Regards
Kaushik Vankayala

[Larry_Gregory]

Hey @kaushik.vankayala,

I can't think of a way to do this with your current document structure. You'll be better off calculating the time difference before indexing the documents into Elasticsearch, and then creating your visualizations from there. You might be able to use the Logstash Elapsed Filter Plugin to accomplish this.

[kaushik.vankayala]

Thanks @Larry_Gregory, looking at the plugin page it seems like a doable thing. I will get back with my findings to see if i have got it working!