# Calculate sum of piecewise linear aggregations on y axis

**URL:** <https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105>\
**Category:** Kibana\
**Created:** [July 14, 2025, 1:20pm UTC](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105 "2025-07-14T13:20:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MagnesiumReroll](https://avatars.discourse-cdn.com/v4/letter/m/e68b1a/32.png) [@MagnesiumReroll](https://discuss.elastic.co/u/MagnesiumReroll)\
**Post date:** [July 14, 2025, 1:20pm UTC](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105/1 "2025-07-14T13:20:34Z")

</div>

Is there a way to represent/calculate the following for y axis :  
count\_1 = count(rows where condition=1)  
count\_2 = count(rows where condition=2)  
...  
sum\_1 = 100 if count\_1\<100 else count\_1  
sum\_2 = 100 if count\_2\<100 else count\_2  
...  
return (sum\_1 +sum\_2...)

I've looked into using new runtime fields but since the calculation requires knowledge of the state of the overall table, it doesn't seem to work.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [July 21, 2025, 6:35am UTC](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105/2 "2025-07-21T06:35:37Z")

</div>

Hello @MagnesiumReroll

Welcome to the community.

Could you please give a sample example with data for better understanding of the requirement & how you want to display it on dashboard?

Thanks!!

---

<div class="post-metadata">

**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\
**Post date:** [July 28, 2025, 2:04pm UTC](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105/3 "2025-07-28T14:04:53Z")

</div>

Hi @MagnesiumReroll

you can use ES|QL for this kind of tasks.  
Here's an example query that reflects your example:

```esql
FROM index
| STATS
  count_1 = count() where extension == "deb",
  count_2 = count() where extension == "zip"
| EVAL 
  sum_1 = CASE(count_1 < 100, 100.0, count_1),
  sum_2 = CASE(count_2 < 100, 100.0, count_2)
| EVAL sum = sum_1 + sum_2
| KEEP sum

```