# Filtered Count in Visual Builder

**URL:** <https://discuss.elastic.co/t/filtered-count-in-visual-builder/170516>\
**Category:** Kibana\
**Created:** [March 1, 2019, 2:41pm UTC](https://discuss.elastic.co/t/filtered-count-in-visual-builder/170516 "2019-03-01T14:41:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gabe.S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabe.s/32/41436_2.png) [@Gabe.S](https://discuss.elastic.co/u/Gabe.S)\
**Post date:** [March 1, 2019, 2:41pm UTC](https://discuss.elastic.co/t/filtered-count-in-visual-builder/170516/1 "2019-03-01T14:41:44Z")

</div>

Hi all, question about Visual Builder: **Is there a way to apply a filter to have multiple count aggregations in a single series? I want to use a math aggregation after to compute a metric.** Why? See below and please tell my how to improve my process!

# Background:

I'm using Elastic Search + Kibana for logging in an application. Mostly, logs come in with a message field (something like `Process A Started`, `Process A Finished Successfully`, `Process A Canceled preemptively`). I'm trying to count the success rate of Process A, but ignore preemptive cancels. Note that if Process A fails we don't necessarily get a `Process A failed`, because the app might have crashed.

Here's the my plan:

1. Count # of messages with `Process A Started`
2. Count # of messages with `Process A Finished Successfully`
3. Count # of messages with `Process A Canceled preemptively` (Right now I also have to divide by 3 due to a logging error, but I'll fix that)
4. Use a math aggregation to subtract cancels from starts, and then divide successful finishes by that number to get `% of non canceled Process As that finished`.

I can't figure out how to do that with Visual Builder or any other visualization. Any help would be appreciated!

---

<div class="post-metadata">

**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\
**Post date:** [March 5, 2019, 11:16pm UTC](https://discuss.elastic.co/t/filtered-count-in-visual-builder/170516/2 "2019-03-05T23:16:14Z")

</div>

Hi @Gabe.S,

You might be able to achieve what you are looking for using [Timelion](https://www.elastic.co/guide/en/kibana/current/timelion.html), with an expression like this:

```auto
.es(q="message:'Process A Started'").subtract(.es(q="message:'Process A Canceled'")).divide(.es(q="message:'Process A Finished'"))

```

But outside of Timelion, I'm not sure there's a way to do exactly what you're looking for.

Performing calculations on the results of multi-bucket aggregations is a use case for [bucket script aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html). These basically let you define a custom metric by using a script to perform per-bucket computations. If you combined these with filters for your specific messages, you could probably get the results you are looking for directly from Elasticsearch.

However, these are unfortunately not yet supported in Kibana. If you're interested, you can follow along with [the relevant Github issue](https://github.com/elastic/kibana/issues/4707) to be notified of any updates.

Thanks,

Luke

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2019, 11:16pm UTC](https://discuss.elastic.co/t/filtered-count-in-visual-builder/170516/3 "2019-04-02T23:16:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.