{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/5182","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/5182/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/5182/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/5182/events","html_url":"https://github.com/elastic/logstash/issues/5182","id":150775853,"number":5182,"title":"Calculate the duration between two log events","user":{"login":"linhntt41","id":18341411,"avatar_url":"https://avatars.githubusercontent.com/u/18341411?v=3","gravatar_id":"","url":"https://api.github.com/users/linhntt41","html_url":"https://github.com/linhntt41","followers_url":"https://api.github.com/users/linhntt41/followers","following_url":"https://api.github.com/users/linhntt41/following{/other_user}","gists_url":"https://api.github.com/users/linhntt41/gists{/gist_id}","starred_url":"https://api.github.com/users/linhntt41/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/linhntt41/subscriptions","organizations_url":"https://api.github.com/users/linhntt41/orgs","repos_url":"https://api.github.com/users/linhntt41/repos","events_url":"https://api.github.com/users/linhntt41/events{/privacy}","received_events_url":"https://api.github.com/users/linhntt41/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/needs%20details","name":"needs details","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-04-25T07:36:00Z","updated_at":"2016-04-25T12:22:06Z","closed_at":null,"body":"Hi all, \r\nI want to calculate time duration of username A, but error \r\n**Ruby exception occurred: can't dup NilClass {:level=>:error} and Ruby exception occurred: undefined method `gsub!' for \"2016-04-25T03:45:00.000Z\":LogStash::Timestamp {:level=>:error}**\r\nElk version: logstash 2.3.1, elasticsearch 2.3.1, kibana 4.5\r\n\r\nfile.log\r\n      Apr 25 13:15:00 A in\r\n      Apr 25 13:16:00 A out\r\nThis is file config:\r\ninput{\r\n        file{\r\n                path =>\"/opt/file.log\"\r\n        }\r\n}\r\nfilter{\r\n        grok {\r\n                match => { \"message\" => \"%{SYSLOGTIMESTAMP:timestamp} %{USERNAME:username} %{WORD:status}\"}\r\n            }\r\n        if [status] == \"in\" {\r\n           mutate {\r\n              rename => {\"timestamp\" => \"[started]\"}\r\n             }\r\n           date {\r\n           match =>[\"[started]\",\"MMM dd HH:mm:ss\",\"ISO8601\"]\r\n           target => \"[started]\"\r\n         }\r\n     }\r\n        if [status] == \"out\" {\r\n          mutate {\r\n              rename => {\"timestamp\" => \"[ended]\"}\r\n             }\r\n           date {\r\n           match =>[\"[ended]\",\"MMM dd HH:mm:ss\",\"ISO8601\"]\r\n           target => \"[ended]\"\r\n         }\r\n        }\r\n          elasticsearch {\r\n              hosts => [\"localhost\"]\r\n              query => \"status:in AND username:%{[username]}\"\r\n              fields => [\"started\",\"ended\"]\r\n         }\r\n        ruby {\r\n          init => \"require 'time'\"\r\n          code => \"event['duration_hrs'] = Time.parse(event['ended']).to_f - Time.parse(event['started']).to_f\"\r\n          add_tag => [\"duration_hrs\"]\r\n        }\r\n}\r\noutput {\r\n        stdout { codec => rubydebug}\r\n        elasticsearch { hosts => [\"localhost:9200\"]\r\n                         index => \"index-%{+YYYY.MM.dd}\"}\r\n}\r\n\r\nThanks"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/214292197","html_url":"https://github.com/elastic/logstash/issues/5182#issuecomment-214292197","issue_url":"https://api.github.com/repos/elastic/logstash/issues/5182","id":214292197,"user":{"login":"purbon","id":68540,"avatar_url":"https://avatars.githubusercontent.com/u/68540?v=3","gravatar_id":"","url":"https://api.github.com/users/purbon","html_url":"https://github.com/purbon","followers_url":"https://api.github.com/users/purbon/followers","following_url":"https://api.github.com/users/purbon/following{/other_user}","gists_url":"https://api.github.com/users/purbon/gists{/gist_id}","starred_url":"https://api.github.com/users/purbon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/purbon/subscriptions","organizations_url":"https://api.github.com/users/purbon/orgs","repos_url":"https://api.github.com/users/purbon/repos","events_url":"https://api.github.com/users/purbon/events{/privacy}","received_events_url":"https://api.github.com/users/purbon/received_events","type":"User","site_admin":false},"created_at":"2016-04-25T12:22:06Z","updated_at":"2016-04-25T12:22:06Z","body":"Interesting issue, I tested with:\r\n\r\nevent.json:\r\n\r\n```json\r\n{ \"ended\": \"2016-04-25T04:45:00.000Z\", \"started\": \"2016-04-25T03:45:00.000Z\"}\r\n```\r\n\r\nconf:\r\n\r\n```bash\r\ninput {\r\n  stdin { codec => json }\r\n}\r\n\r\nfilter {\r\n  ruby {\r\n    init => \"require 'time'\"\r\n    code => \"event['duration_hrs'] = Time.parse(event['ended']).to_f - Time.parse(event['started']).to_f\"\r\n    add_tag => [\"duration_hrs\"]\r\n   }\r\n}\r\n\r\noutput {\r\n  stdout {\r\n   codec => rubydebug\r\n  }\r\n}\r\n```\r\n\r\nand got:\r\n\r\n```bash\r\nskywalker% cat event.json | ./logstash-2.3.0/bin/logstash -f date_diff.conf\r\nSettings: Default pipeline workers: 4\r\nPipeline main started\r\n{\r\n           \"ended\" => \"2016-04-25T04:45:00.000Z\",\r\n         \"started\" => \"2016-04-25T03:45:00.000Z\",\r\n        \"@version\" => \"1\",\r\n      \"@timestamp\" => 2016-04-25T12:15:18.194Z,\r\n            \"host\" => \"skywalker\",\r\n    \"duration_hrs\" => 3600.0,\r\n            \"tags\" => [\r\n        [0] \"duration_hrs\"\r\n    ]\r\n}\r\n```\r\n\r\nmy thoughts are confused here, would be nice to that you take this conf in parts and try to see where this error might be coming from, certainly is not from the ruby filter parse as strings, so I guess the error might be comming from:\r\n\r\n```ruby \r\ncode => \"event['duration_hrs'] = Time.parse(event['ended']).to_f - Time.parse(event['started']).to_f\"\r\n```\r\n\r\nbecause at this point `event['ended']` and  `event['started']` are not strings, but from Timestamp class, can you make sure to either, to the `-` between them, without the parse, or do a `.to_s` when doing the parse?\r\n\r\nI guess this might fix your issue."}}