# Elasticsearch, ingest API and summation two numbers in field of the document

**URL:** <https://discuss.elastic.co/t/elasticsearch-ingest-api-and-summation-two-numbers-in-field-of-the-document/179913>\
**Category:** Elasticsearch\
**Created:** [May 7, 2019, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-ingest-api-and-summation-two-numbers-in-field-of-the-document/179913 "2019-05-07T07:47:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![unix196](https://avatars.discourse-cdn.com/v4/letter/u/0ea827/32.png) [@unix196](https://discuss.elastic.co/u/unix196)\
**Post date:** [May 7, 2019, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-ingest-api-and-summation-two-numbers-in-field-of-the-document/179913/1 "2019-05-07T07:47:12Z")

</div>

Good day. We use elasticsearch 6.7.1 and Ingest API for receiving logs from filebeats.  
We set this pipeline (some processors removed for clarity):

```
{
"description": "balancer pipeline",
"processors": [
{
"split": {
"field": "upstream_header_time",
"separator": ",\\s+",
"target_field": "upstream_header_time_new",
"ignore_failure" : true
}
}
]

```

In Kibana I see this

![Selection_001](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ea8e99b8966954894a39bfe6aa7b37cd845df6f.png)

**upstream\_header\_time** and **upstream\_header\_time\_new** don't differ becasue split processor this way works (I think he works like that:) ) - on exit it creates two numbers, which comma separated.  
It's OK.  
Then I want add new processor to this pipeline, which summarizes this two numbers. I think processor **script** with painless language can help me. But I lack knowledge.  
I guess such steps:

- field upstream\_header\_time\_new transform to list
- summ two elements in list

I try add this processor to pipeline, but it didnt work (syntax error):

```
{
"script": {
"lang": "painless",
"source": """
String[] headerSplit = split(ctx.upstream_header_time_new, char ",");
ctx.field_new = (headerSplit[0] + headerSplit[1]);
"""
}
}

```

Can anyone help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2019, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-ingest-api-and-summation-two-numbers-in-field-of-the-document/179913/2 "2019-06-04T07:47:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.