Kibana subtracting the values of 2 indices

Question

I have 2 indices in kibana 4:

1st index is basing time from events (Date Created)

2nd Index is basing time from events (Date Closed)

Both are date values and I want to create a query which will return the total amount of docs Date Created (Today) - total amount of docs Date Closed (Today)

If this is not possible is it possible if i have both fields in one index?

Answer 1

Yes you need to have both the date values within the same index so that you can do the subtraction using a scripted field in Kibana . You could simply have your script as such:

doc.['date_created'].value - doc.['date_closed'].value

----------------^----------------------------------------^ Make sure to give your exact field names

And then you could use this scripted field as a Date Historgram to show the total count of the docs within the retrieved date range.

Hope this helps!