Continuous query with elapsed transformation

1

Hi,
I use influxdb to monitor VPN access. A record is generated at each login / logout of an user. I get the following result in influxdb:

select * from vpn
name: vpn
time                Id        Type      etat           host           ip            user
1538430263718995024 53        win7      connexion      192.168.165.1  78.221.56.59  jdupont
1538434238902469237 53        win7      deconnexion    192.168.165.1  78.221.56.59  jdupont

Now I want to create a continuous query that measures the time between login and logout. I tried this:

SELECT elapsed("ip",1s) as "duration" from un_jour.vpn group by "user","Id"

Return :

tags: connId=53, user=jdupont
time                duration
----                --------
1538434238902469237 3975

When I create continuous query with the same query like this :

create continuous query duration_cq_1h ON vpn BEGIN SELECT elapsed("ip",1s) as "duration" INTO "un_an" from "un_jour" group by time(1h),"user","Id","Type","host" END

They do nothing and return an error in logfile:

aggregate function required inside the call to elapsed

Can someone help me?
Thanks.