# Best practice to aggregate by issue status
**URL:** https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596
**Category:** Kibana
**Tags:** lens
**Created:** [January 8, 2024, 2:41pm UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596 "2024-01-08T14:41:12Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@lizozom](https://discuss.elastic.co/u/lizozom)
#### Post date: [January 8, 2024, 2:41pm UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/1 "2024-01-08T14:41:12Z")
I have an index that stores logs of issue status changes (imaging something like GH issues). An issue can be either open or closed.
I want to show a metric of how many issues are currently open or closed.
What would be the appropriate way to create such a visualization?
i.e. within the given time frame:
- 20 issues were closed
- 10 issues remain open
Thank you
---
### Author:  [@Priscilla\_Parodi](https://discuss.elastic.co/u/Priscilla_Parodi)
#### Post date: [January 8, 2024, 8:47pm UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/2 "2024-01-08T20:47:41Z")
Hello @lizozom,
A [metric visualization](https://www.elastic.co/guide/en/kibana/8.11/add-aggregation-based-visualization-panels.html) would be good.
Example (in this case 200, 404, 503), [count aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/search-aggregations-metrics-valuecount-aggregation.html).
Then you can add a filter specifically for open or closed.
Example: `status.keyword : "open"`
---
### Author:  [@lizozom](https://discuss.elastic.co/u/lizozom)
#### Post date: [January 9, 2024, 9:10am UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/3 "2024-01-09T09:10:53Z")
Let me clarify my use case:
When the issue is opened, a log is added saying issue #1234 is opened on the 01-01-2024 08:00:00.
Then when the issue is closed, a log is added, saying issue #1234 is closed on the 01-01-2024 10:00:00.
If I use a simple metric visualization, I would get +1 on the open AND on the closed counters. I want the issue to be either open OR closed, so that it's not counted twice.
I used a Transform to aggregate the data by issue ID, but I was wondering if there was a more convenient way of doing this.
---
### Author:  [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)
#### Post date: [January 9, 2024, 11:44am UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/4 "2024-01-09T11:44:10Z")
Hi @lizozom ,
the only alternative to the `Transform` approach I can think of is building 2 distinct metric visualisations with raw documents:
- first one for the `Still open` issues will have the `count(kql='status.keyword: "open"') - count(kql='status.keyword: "closed"')` formula
- second one for the `Closed ones` will have a count with the `'status.keyword: "closed"'` filter on it.
---
### Author:  [@lizozom](https://discuss.elastic.co/u/lizozom)
#### Post date: [January 9, 2024, 1:15pm UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/5 "2024-01-09T13:15:33Z")
The `Transform` approach sounds good then!
Good they were added.
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 6, 2024, 1:16pm UTC](https://discuss.elastic.co/t/best-practice-to-aggregate-by-issue-status/350596/6 "2024-02-06T13:16:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.