Visualizing duration using timestamps from the same data point

[whatchett (Wes Hatchett)]

Searching for 'duration' in this forum, I've come across some use cases that sound close to mine (using scripted fields), but they all seem to bring in an additional complexity.

My application is looking at data from motion detectors. I have data coming from any given sensor that resembles the following in my Discover view:

[motion 1] value = true, time: 09:50:00
[motion 1] value = false, time: 09:14:00
[motion 1] value = true, time: 09:00:00

My goal is to create a chart for the day that fills in color for the period of 9-9:14, then picks up again at 9:50, etc.

Put another way, I want to visualize duration using the changes between true/false as my start/stop event.

A slightly more complex take on the same problem would be in string fields, where I get data in plain language form from what is essentially a heat map of the area to represent traffic patterns.

[density 1] value = High, time: 10:50:00
[density 1] value = Medium, time: 09:45:00
[density 1] value = Low, time: 09:35:00
[density 1] value = Medium, time: 09:00:00

My goal here is the same, to chart the time periods in which these various conditions were met based on when the value changed.

It seems straightforward in my mind—any help would be greatly appreciated.

[Nathan_Reese]

I would recommend creating a event stream that contains durations. Set up a program that monitors the original data flow. When a new event comes in, create a new event that captures the duration since the last event. Send the new event to Elasticsearch and create your graphics from that event stream.

[whatchett (Wes Hatchett)]

Thanks for the reply. In short, you don't think that scripted fields will be able to play a role in this to keep the solution on the Kibana side with the data that exists currently?

I'm hoping not to have to add anything else to our software stack, and since I have seen examples of where @timestamp can be used in scripted fields I was thinking there could be an easier answer.