Calculate time delta between events

Is there a method to calculate the time difference between two logged events? For example if event #1 occurred at 00:00:01 and event #7 occurred at 00:00:23 to do some math and determine that 22 seconds elapsed between those 2 events?

That’s unfortunately not possible with Graylog out of the box.

Thanks for the reply jochen. Can you give me an idea of what path I’d need to go down to get this to work? Is this a matter of doing something with a pipeline or would I need to get deeper than that? I know that I can do this with elapsed in ELK and transaction in Splunk but I’m really liking Graylog and would much prefer to stick with it. TIA!

You could write a script running multiple search queries using the Graylog REST API and use the response to calculate the values you’re interested in.

Beautiful, thank you very much for the insight. I really appreciate it.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.