Combine different log events in one data table

[thomasneirynck]

@bab

This would requires support for a bucket script in Kibana data-tables, which there is not now https://github.com/elastic/kibana/issues/4707

You could run this query manually too in dev-tools.

This would be an example of how to do it:

Elasticsearch bucket_script to subtract two timestamps

Do you need those firstUrl and lastUrl aggregations to be terms aggregations? Because if you change those to min and max aggregations the solution is simple: { "query": { "bool": { "filter": { "range": { "page.time": { "gte": "now-w", "lte": "now" } } } } }, "aggs": { "sessionLengthData": { "terms": { "field": "sId.keyword", "size": 10 }, "aggs": { "firstUrl": { …

• top-level term-aggregation on tradeReference
• min sub aggregation to get minimum date
• max sub-aggregation to get maximum date
• bucket sub-aggregation to subtract max from min