Search code examples
elastic-stackkibana-5

Subtract two values in Kibana for specific timestamps


This is the first time Im doing this and cant seem to find an online resource.

The index is aggregated at a daily level. So one record per day.

26 April:

    {
  "_index": "gamers",
  "_type": "dailyAgg",
  "_id": "dailyAgg-2015-04-26T00:00:00Z",
  "_score": null,
  "_source": {
    "timestamp": "2017-04-26T00:00:00Z",
    "player_count": 800
  },
    "timestamp": [
      1493164800000
    ]
  },
  "sort": [
    1493164800000
  ]
}

25 April:

{
  "_index": "gamers",
  "_type": "dailyAgg",
  "_id": "dailyAgg-2017-04-25T00:00:00Z",
  "_score": null,
  "_source": {
    "timestamp": "2017-04-25T00:00:00Z",
    "player_count": 500
  },
    "timestamp": [
      1493078400000
    ]
  },
  "sort": [
    1493078400000
  ]
}

What I need is:

player_count(Today) - player_count(Yesterday)

=> player_count(26 April) - player_count(25 April) = 800 - 500 = 300

I've tried scripted field and painless scripts, but cant pull the data for the given date.


Solution

  • This is the solution I ended up using: Custom Plugin