# Visualization to view the difference of time for two events with a particular field value

**URL:** <https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896>\
**Category:** Kibana\
**Created:** [July 6, 2018, 11:09am UTC](https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896 "2018-07-06T11:09:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaushik.vankayala](https://avatars.discourse-cdn.com/v4/letter/k/aca169/32.png) [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\
**Post date:** [July 6, 2018, 11:09am UTC](https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896/1 "2018-07-06T11:09:18Z")

</div>

Hi There,

I am a total newbie to the ELK stack. I have recently developed a logstash pipeline successfully for a custom log of an application and now i have the data on elasticsearch and indexed in kibana as expected. Now i have great challenge with creating a visualization for some data. The use-case is explained as below, please help if you can.

_FYI : The log structure and the issues faced in stashing are listed out [here](https://discuss.elastic.co/t/logstash-config-issue-for-a-custom-log-file/138539)._

Now, for those who are interested in just assisting with my issue;

I have events with a field _type_ having value as _Audit-IN_ and _Audit-OUT_ in my index on a highlevel view. They have some similar fields and some different. Now there is a _timehit_ field in both of the events and a field named as _transactionid_ which will have the same value for both types. At any time, for a particular transactionid the Audit-IN will be the first and then follows the Audit-OUT with respect to time.

My use-case is to visualize all the transaction IDs are some selected ones and find the difference between the time stamps.

I am confused as to what type of visualization to be used and how to configure it.

The view of a Audit-IN document in kibana is as follows;

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4da75518af666a6d7b44891907a68ab14d0eeb32.png)

The view of a Audit-OUT document in kibana is as follows;

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48cc2cb6794c70a593940a7d7e8336be32988188.png)

As per the above screen shot and the fields marked in green,  
The time taken between the Audit-IN and Audit-OUT of the transactionid (0e90862318794eb587ed93ef800cf62d) is 359 ms.

Thanks & Regards  
Kaushik Vankayala

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [July 6, 2018, 12:22pm UTC](https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896/2 "2018-07-06T12:22:21Z")

</div>

Hey @kaushik.vankayala,

I can't think of a way to do this with your current document structure. You'll be better off calculating the time difference before indexing the documents into Elasticsearch, and then creating your visualizations from there. You might be able to use the [Logstash Elapsed Filter Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-elapsed.html) to accomplish this.

---

<div class="post-metadata">

**Author:** ![kaushik.vankayala](https://avatars.discourse-cdn.com/v4/letter/k/aca169/32.png) [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\
**Post date:** [July 18, 2018, 10:07am UTC](https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896/3 "2018-07-18T10:07:54Z")

</div>

Thanks @Larry_Gregory, looking at the plugin page it seems like a doable thing. I will get back with my findings to see if i have got it working! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2018, 10:07am UTC](https://discuss.elastic.co/t/visualization-to-view-the-difference-of-time-for-two-events-with-a-particular-field-value/138896/4 "2018-08-15T10:07:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.