# Aggregat about data

**URL:** <https://discuss.elastic.co/t/aggregat-about-data/99690>\
**Category:** Logstash\
**Created:** [September 7, 2017, 8:45am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690 "2017-09-07T08:45:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 7, 2017, 8:45am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/1 "2017-09-07T08:45:54Z")

</div>

Hello,

I search to put aggregat on my data.

Here a party of my data :

```
TYPE	Usage
FREEUSER	345
PREMIUM_USER	8653
FREEUSER	1369
FREEUSER	87654
PREMIUM_USER	43678
FREEUSER	8654
PREMIUM_USER	2387
FREEUSER	98723
FREEUSER	45873
PREMIUM_USER	2847
PREMIUM_USER	89235
USER_UNKNOW	16235
USER_GOLD	32457

```

My aim is :

To sum Usage by type of client, example :

For user no gold, i want know the sum of usage :

So, USER\_PREMIUM & FREEUSER, USER\_UNKNOW have use a total of 405 653 octets.

Currentl, in kibana when i test this, i have the sum of usage by type of user 😕

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 7, 2017, 9:02am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/2 "2017-09-07T09:02:46Z")

</div>

I thought that in filter of logstash :

if [TYPE] == "FREEUSER or PREMIUMUSER or UNKNOW\_USER" {  
aggregate {  
task\_id =\> "%{taskid}"  
code =\> "map['USAGE'] ||= 0 ; map['USAGE'] += event.get('USAGE\_no\_gold')"  
}  
}

What do you think

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 7, 2017, 9:45am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/3 "2017-09-07T09:45:14Z")

</div>

In general I suggest you perform aggregations in Elasticsearch (typically via Kibana), not Logstash. The Kibana group can give suggestion for how to solve your problem.

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 7, 2017, 9:46am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/4 "2017-09-07T09:46:08Z")

</div>

I have also see, we can parameter this in Kibana with devtool ?

{  
"query" : {  
"constant\_score" : {  
"filter" : {  
"match" : { "TYPE" : "PREMIUMUSER, FREEUSER, UNKNOW\_USER" }  
}  
}  
},  
"aggs" : {  
"sum\_no\_gold\_user" : { "sum" : { "field" : "USAGE" } }  
}  
}

Can you explain me the difference between solutions ?

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 7, 2017, 9:46am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/5 "2017-09-07T09:46:41Z")

</div>

> [@magnusbaeck](#):
>
> In general I suggest you perform aggregations in Elasticsearch (typically via Kibana), not Logstash. The Kibana group can give suggestion for how to solve your problem.

aha Thank you @magnusbaeck i put the question simultaneous

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 7, 2017, 2:59pm UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/6 "2017-09-07T14:59:01Z")

</div>

@magnusbaeck Sorry but, you seem a hero of ELK Stack.

What do you think about painless scripted field ? Is deprecated no ?

I find use of DevTool more intuitive.

Here a proposed solution:  
 ![f068d89d03b54ebc23934c13529cfde7e2e4cf1b_1_678x500](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8ae2cc399526d12d434afce3710b9aa97be34a70.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 8, 2017, 6:09am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/7 "2017-09-08T06:09:09Z")

</div>

Painless was introduced in ES 5.0 and has not been deprecated.

---

<div class="post-metadata">

**Author:** ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Post date:** [September 8, 2017, 8:42am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/8 "2017-09-08T08:42:57Z")

</div>

thank you @magnusbaeck you are amazing.

To close this topic, we must wait 1 month ?

See you soon

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2017, 8:43am UTC](https://discuss.elastic.co/t/aggregat-about-data/99690/9 "2017-10-06T08:43:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.