This function computes the number of milliseconds in a certain fixed time
period. It is used to make timestamp comparisons easier, more readable and
less error-prone.
Hide omitted argument names for this functionShow omitted argument names for this function
Omitted Argument Names
The argument name for duration can be omitted; the following forms of this function are equivalent:
logscale Syntax
duration("value")
and:
logscale Syntax
duration(duration="value")
These examples show basic structure only.
The function returns (in the field selected by the
as argument) the number of
milliseconds in the duration described by the
duration argument. The
syntax and semantics of the
duration argument is exactly
the duration specification mini-language used elsewhere in the system; for
more information on time duration, see
Relative Time Syntax.
Click + next to an example below to get the full details.
Compare Two Timestamps
Query
logscale
diff:=endTime-startTime|test(diff>duration("5m"))
Introduction
The duration() function returns the number of
milliseconds for a given duration specification. This value can be
used as the basis for comparison for different values. In this
example, the function is used to compute a simple value to use in
a comparison. The input data contains the
startTime and
endTime for an operation,
to determine whether the difference between the two exceeds a
duration of 5 minutes.
Step-by-Step
Starting with the source repository events.
logscale
diff:=endTime-startTime
Determines the difference between the
endTime and
startTime; the fields
should be in milliseconds (as they would be for an epoch or
timestamp).
logscale
|test(diff>duration("5m"))
Use the test() function to determine if the
computed difference is greater than a duration of 5 minutes. In
this case, duration() returns 300,000.
Event Result set.
Summary and Results
The duration() functions supports a more
convenient, and human-readable, method of defining a duration
without needing to explicitly calculate the comparison. This is
particularly useful when using parameters on a dashboard.
Narrow the Search Interval
Query
logscale
test(@timestamp>now()-duration("2d"))
Introduction
When searching across a range of timestamps, the ability to limit
the search to a more specific range using a relative duration can
limit the output. To achieve this with the search, make use of
duration() with a relative time, for example
2d for two days and use this
to compare against the current time and
@timestamp of the event.
Step-by-Step
Starting with the source repository events.
logscale
test(@timestamp>now()-duration("2d"))
Creates a value based on a duration of
2d (two days). This
returns a value in milliseconds (2 * 24
* 60 * 60 * 1000). By subtracting the value from
now() the value is two days ago from the
time the event is executed. Then the value is compared to the
@timestamp to filter the events.
Event Result set.
Summary and Results
The result is syntactically equivalent to:
logscale
test(@timestamp>now()-172800000)
As the value is in a human-readable and relative time syntax,
the value can be used in dashboards and user-selected
parameters.