# Diff of 2 terms aggregations

**URL:** <https://discuss.elastic.co/t/diff-of-2-terms-aggregations/251021>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring, elastic-stack-security, elastic-stack-alerting\
**Created:** [October 5, 2020, 3:40pm UTC](https://discuss.elastic.co/t/diff-of-2-terms-aggregations/251021 "2020-10-05T15:40:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Florent\_Fauvin](https://avatars.discourse-cdn.com/v4/letter/f/d2c977/32.png) [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\
**Post date:** [October 5, 2020, 3:40pm UTC](https://discuss.elastic.co/t/diff-of-2-terms-aggregations/251021/1 "2020-10-05T15:40:11Z")

</div>

Hello,

I want to create 2 terms aggregations :

```auto
"allUsers" : {"terms": {"field": "User"}}
"allPresentUsers"	: {"terms": {"field": "PresentUser"}}

```

_=\> Then, I want to find the absent users._

_So, I want to create a third aggregation which lists the users from "allUsers" who are not in "allPresentUsers"._

Do you know how I can do this with Elasticsearch ?  
Are there different ways to approach the problem ?

Thank you for your help,

Florent

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [October 8, 2020, 7:08pm UTC](https://discuss.elastic.co/t/diff-of-2-terms-aggregations/251021/2 "2020-10-08T19:08:29Z")

</div>

You will need to create this data on your own by running those queries, and post-processing the results using a script. You can take the post-processed data and index it into a new ES index, which will allow you to analyze how you want.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2020, 7:08pm UTC](https://discuss.elastic.co/t/diff-of-2-terms-aggregations/251021/3 "2020-11-05T19:08:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.