# Calculate increments in a specific field

**URL:** <https://discuss.elastic.co/t/calculate-increments-in-a-specific-field/75470>\
**Category:** Kibana\
**Created:** [February 17, 2017, 10:10am UTC](https://discuss.elastic.co/t/calculate-increments-in-a-specific-field/75470 "2017-02-17T10:10:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmartin1](https://avatars.discourse-cdn.com/v4/letter/r/3da27b/32.png) [@rmartin1](https://discuss.elastic.co/u/rmartin1)\
**Post date:** [February 17, 2017, 10:10am UTC](https://discuss.elastic.co/t/calculate-increments-in-a-specific-field/75470/1 "2017-02-17T10:10:45Z")

</div>

With the new funcionality Logstash-Api in Logstash 5.2.1 I have the need of represent in kibana the number of [pipeline.events.in](http://pipeline.events.in) but I don´t like the cumulative sum (that i can get with timelion) I would wish represent the increment of the number of envents that enter along the logstash.

For example:  
with http poller I get [pipeline.events.in](http://pipeline.events.in) field every minute:  
0,2,2,6 (in the inicial time i have 0 events throught logstash, in the second and third minute, i have 2 events also, in the 4º minute logstash had processed 6 events since start...)

I need to visualize the increments: 0,2,0,4

It´s possible? Some ideas?

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [February 18, 2017, 1:42pm UTC](https://discuss.elastic.co/t/calculate-increments-in-a-specific-field/75470/2 "2017-02-18T13:42:28Z")

</div>

Try adding `.derivative()` to the end of your timelion expression? That should only plot the deltas between adjacent points.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2017, 1:42pm UTC](https://discuss.elastic.co/t/calculate-increments-in-a-specific-field/75470/3 "2017-03-18T13:42:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.