extra/docker/elk/tools/EsAutoQuery/closedLoopAlarmDuration.json

{
    "query" : {
        "bool": {
            "must": [
                { "match": { "closedLoopEventStatus": "ABATED" } }
            ]
        }
    },
    "script_fields" : {
        "closedLoopAlarmDuration" : {
            "script" : {
                "lang": "painless",
                "source": "
if (doc.get('closedLoopEventStatus.keyword').value == 'ABATED') {
   return doc.get('closedLoopAlarmEnd').value - doc.get('closedLoopAlarmStart').value;
}
return null
"
            }
        }
        , "closedLoopAlarmStart" : {
            "script" : {
                "lang": "painless",
                "source": "doc['closedLoopAlarmStart']"
            }
        }
        , "closedLoopAlarmEnd" : {
            "script" : {
                "lang": "painless",
                "source": "doc['closedLoopAlarmEnd']"
            }
        }
    }
}