title: Calculating time between events
body: <p>I have a message that flows through several systems, each system logs message entry and exit with a timestamp and a uuid messageId. I'm ingesting all logs through:</p>
  
  <pre><code>filebeat --&gt; logstash --&gt; elastic search --&gt; kibana
  </code></pre>
  
  <p>As a result I now have these events: </p>
  
  <pre><code>@timestamp                      messageId                               event 
  May 19th 2016, 02:55:29.003     00e02f2f-32d5-9509-870a-f80e54dc8775    system1Enter
  May 19th 2016, 02:55:29.200     00e02f2f-32d5-9509-870a-f80e54dc8775    system1Exit
  May 19th 2016, 02:55:29.205     00e02f2f-32d5-9509-870a-f80e54dc8775    system2Enter
  May 19th 2016, 02:55:29.453     00e02f2f-32d5-9509-870a-f80e54dc8775    system2Exit
  </code></pre>
  
  <p>I would like to produce a report (ideally a stacked bar or column) of time spent in each system:</p>
  
  <pre><code>messageId                               in1:1-&gt;2:in2
  00e02f2f-32d5-9509-870a-f80e54dc8775    197:5:248
  </code></pre>
  
  <p>What is the best way to do this? Logstash filters? kibana calculated fields?</p>