# Bucket Script Aggregation per Bucket in TSVB possible?

**URL:** <https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317>\
**Category:** Kibana\
**Created:** [April 9, 2020, 12:21pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317 "2020-04-09T12:21:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cyverboy2](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@cyverboy2](https://discuss.elastic.co/u/cyverboy2)\
**Post date:** [April 9, 2020, 12:21pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317/1 "2020-04-09T12:21:46Z")

</div>

Hey there,

my data looks like this:

- Unique ID with should be my buckets
- Count: Number of entrys per Unique ID, each entry has a separate count value
- Max: max number of entry per Unique ID
- Min: min number of entry per Unique ID  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/9/09849efaa46c849ac0da62004cc675577990bd49.png)

What I want to do now is  
[((Sum of Max) - (Sum of Min)] / (Sum of Count) = Desired loss rate

Is this possible in TSVB? It works for me with one Unique ID, but how can I do this with all Unique IDs?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38f8b8ef8ce4569d8bc300ac9e6bf895c15050a3.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [April 9, 2020, 12:53pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317/2 "2020-04-09T12:53:01Z")

</div>

I'm not 100% sure what your question is, sorry If I misunderstand what you mean.

You can group by unique id using "Group By" for the series:

 ![Screenshot 2020-04-09 at 14.50.46](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f3886a80f1e6c34a3251a433c9c9f0055fbcfb3.png)

If you set that to "Everything", you will get the value for all ids overall.

If you want to see both at once (split by unique id plus overall values) you can clone the series one just set the "Group by" for one of them.

---

<div class="post-metadata">

**Author:** ![cyverboy2](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@cyverboy2](https://discuss.elastic.co/u/cyverboy2)\
**Post date:** [April 9, 2020, 1:25pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317/3 "2020-04-09T13:25:25Z")

</div>

Thanks for your reply and sorry for being not clear. I try to clarify it:

I want to figure out how much messages are getting lost during transmission. Therefore I want to count the incoming messages (column COUNT) compared to the expected messages. Each message per transmission session (column Unique ID) has a ascendig counter value, so I can calculate the expected messages by  
**Max Counter value - Min counter value = expected number of messages**

The loss rate is then calculated by  
**1 - (Count / expected number of messages) = loss rate**

In TSVB I want to visualize the loss rate over time for all Sessions, therefore I try to sum up all values for Count, Max and Min by each session. It should look like this then:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/7/e7d8c13d4f95882be12349c12a61ef93a6c8af8c.png)

Is this possible?

Your solution works perfectly, if I want to check the loss rate per session, but I need to know the overall loss rate!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d202da5aaeb1d4f2306fb73089af35e80820fb18.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08996e0a211c9a31e5e9b7902e71fe596233e00d.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [April 9, 2020, 2:48pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317/4 "2020-04-09T14:48:43Z")

</div>

I see, unfortunately I think you can't configure such complex aggregations in TSVB. You should be able to get the individual metrics (Sum of Count, Sum of Max and Sum of Min) in the regular visualization types by using the "Sum Bucket" aggregation, but there you can't apply the formula afterwards...

From what I can tell the only option left is to use a vega vis which allows you to write the Elasticsearch query yourself. Three "bucket sum" pipieline aggregations ([https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-sum-bucket-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-sum-bucket-aggregation.html)) on top of a terms agg on the id field with three nested metrics (sum, max and min) and then a bucket script aggregation applied on those bucket sums should do the trick.

Let me know if you need help with this approach, I'm sure we can get it to work.

For a TSVB solution - maybe someone else has another idea.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2020, 2:48pm UTC](https://discuss.elastic.co/t/bucket-script-aggregation-per-bucket-in-tsvb-possible/227317/5 "2020-05-07T14:48:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
