# Analyse difference of count parameters **URL:** \ **Category:** Kibana\ **Created:** [January 9, 2020, 10:07am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406 "2020-01-09T10:07:22Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Post date:** [January 9, 2020, 10:07am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/1 "2020-01-09T10:07:22Z")
Hi All, I'm currently reporting user login and logout logs to Elasticsearch. Now I want to get the current logged i user count. Document structure is simply as below { "userId": "user1", "eventType": "LOGIN" ... } { "userId": "user2", "eventType": "LOGIN" ... } { "userId": "user1", "eventType": "LOGOUT" ... } So at a given point of time, current logged-in user count will be derived from the difference between record count of entityType=LOGIN and entityTyple=LOGOUT. I want to get the count and plot the trend in line graph. May I know is it possible to visualize this kind of count difference as a number and line graph? If so any tips would be really appreciated. Thanks in advance ---
**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\ **Post date:** [January 9, 2020, 9:06pm UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/2 "2020-01-09T21:06:37Z")
You can use TSVB to do this. Recently there was another topic that shows how to use a Bucket Script aggregation in TSVB to have a line chart with calculated values. See: [Tsvb - Sort by bucket script's value?](https://discuss.elastic.co/t/tsvb-sort-by-bucket-scripts-value/214073) ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47ed2fa227bd23e65952cbfc91eb52dc692f7f4f.png) ---
**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Post date:** [January 10, 2020, 2:42am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/3 "2020-01-10T02:42:39Z")
Hi @tsullivan, thank you for your prompt response. I have one more thing to clarify. As I can understood from TSVB, we cannot apply two filtering criteria for two aggregations. Unfortunately, in my case first aggregation (count) should have filtering criteria - eventType: Login and then the other aggregation (count) should have filtering criteria - eventType: LOGOUT. Any thoughts around this? Thanks in advance. ---
**Author:** ![Skeeve](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Skeeve](https://discuss.elastic.co/u/Skeeve)\ **Post date:** [January 10, 2020, 6:44am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/4 "2020-01-10T06:44:16Z")
Hi @Manjula_Piyumal. I seem to remember I had a similar question to yours some time ago. The issue with your approach is: You will get negative user counts when you filter on time and do not start at a time where no user is logged in. If at time n where m users are logged in but you start your count at time n+1 you start with 0 logged in users. Every user logging out now, without others logging in, will result in a negative user count. ---
**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Post date:** [January 10, 2020, 7:20am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/5 "2020-01-10T07:20:09Z")
Hi @Skeeve yes, you are absolutely correct. I'm experiencing it now. May I know how did you approach your problem? One possible solution would be intercepting the logs and do some pre-processing before sending the Elasticsearch. Am trying to avoid that approach and use Elasticsearch directly. I can change the data schema, but as per my log file, I only have the data to derive whether it's a login or logout event and the user id. Thanks ---
**Author:** ![Skeeve](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Skeeve](https://discuss.elastic.co/u/Skeeve)\ **Post date:** [January 10, 2020, 7:37am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/6 "2020-01-10T07:37:52Z")
As usual for me with Kibana: I have no solution ☹ Sorry. What I would suggest for your case is to log the current amount of users (if possible) I asssume that, at every log in and logout , the system itself knows the number of current users. ---
**Author:** ![Manjula\_Piyumal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manjula_piyumal/32/57068_2.png) [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Post date:** [January 10, 2020, 7:45am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/7 "2020-01-10T07:45:25Z")
No worries. Unfortunately in my case I don't have a control over application and application team definitely won't agree to accept any changes. I'm thinking of considering the ability to intercept the logs and keep the state there. Thanks anyway for your inputs ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 7, 2020, 7:45am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406/8 "2020-02-07T07:45:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.