如何在kibana 4.x中获取字段的总值

Question

I need to get the total value of field in Kibana using script field .

eg) if id field have values like 1, 2, 3, 4, 5

I am looking to sum up all the values of id, I am expecting the output is 15.

I need to achieve the below formula after getting total of each field.

lifetime=a-b-c-(d-e-f)*g

here a,b,c,d,e,f,g all are total of the each field values.

for more info please refer this question which is raised by me.

Answer 1

You could do something like this in your scripted fields :

doc['id'].value

Hence, you could use a sum aggregation to get the total value in Kibana .

This SO could be handy!

EDIT

If you're trying to do it using Elasticsearch , you could do something like this within your request body:

"aggs":{  
         "total":{  
             "sum":{  
                 "script":"doc['id'].value"
             }
          }
      }

You could follow up this ref , but then if you're using painless make sure you do include it within lang . related SO

Answer 2

You can definitely use sum aggregations to get the sum of id, but to further equate your formula, you can take a look at pipeline aggregations to use the sum value for further calculations.

Take a look at bucket script aggregation , with proper bucket path to sum aggregator you can achieve your solution.

For sample documents

{
  "a":100,
  "b":200,
  "c":400,
  "d":600
}

query

 {
   "size": 0,
   "aggs": {
      "result": {
         "terms": {"script":"'nice to have it here'"},
         "aggs": {
            "suma": {
                "sum": {
                    "field": "a"
                }
            },
            "sumb": {
                "sum": {
                  "field": "b"
                }
            },
            "sumc": {
                "sum": {
                  "field": "c"
                }
            },
            "equation": {
                "bucket_script": {
                    "buckets_path": {
                        "suma": "suma",
                        "sumb": "sumb",
                        "sumc" : "sumc"
                    },
                    "script": "suma + sumb + 2*sumc"
                }
            }
        }
      }
   }
}

Now you can surely add term filter on each sum agg to filter the summation for each sum aggregator.