# Find differenence of a fields from 2 bucket values

**URL:** <https://discuss.elastic.co/t/find-differenence-of-a-fields-from-2-bucket-values/133166>\
**Category:** Elasticsearch\
**Created:** [May 24, 2018, 2:03pm UTC](https://discuss.elastic.co/t/find-differenence-of-a-fields-from-2-bucket-values/133166 "2018-05-24T14:03:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leela\_kumili](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leela_kumili/32/85841_2.png) [@leela\_kumili](https://discuss.elastic.co/u/leela_kumili)\
**Post date:** [May 24, 2018, 2:03pm UTC](https://discuss.elastic.co/t/find-differenence-of-a-fields-from-2-bucket-values/133166/1 "2018-05-24T14:03:29Z")

</div>

Hi,

I have a requirement where I want to find number total number of hits for for each 1 hours interval for last 2 hours and find diff between total hits of current hours to previous hours for each action , how can i bucket script for that

Here is my aggs:

```auto
{
     "size": 0,
          "aggs": {
            "group_by_hits":
            {
              "terms": {
                "field": "action"
              },
                      "aggs": {
                        "range": {
                          "date_range": {
                            "field": "Date",
                            "ranges": [
                              {
                                "from": "now-2h",
                                "to": "now-1h",
                                "key": "earlier"
                              },
                              {
                                "from": "now-1h",
                                "to": "now",
                                "key": "latest"
                              }
                            ],
                            "keyed": true
                          },
                          "aggs": {
                            "total_count": {
                              "sum": {
                                "field": "count"
                              }
                            }
                          }
                        }
}
            }
          }
}

```

Sample Results:

```auto
{
  "took": 281,
  "timed_out": false,
  "_shards": {
    "total": 91,
    "successful": 91,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3139730,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "group_by_hits": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "ATB",
          "doc_count": 2613996,
          "range": {
            "buckets": {
              "earlier": {
                "from": 1527163240388,
                "from_as_string": "Thu May 24 08:00:40 2018 -0400",
                "to": 1527166840388,
                "to_as_string": "Thu May 24 09:00:40 2018 -0400",
                "doc_count": 4416,
                "total_count": {
                  "value": 26178
                }
              },
              "latest": {
                "from": 1527166840388,
                "from_as_string": "Thu May 24 09:00:40 2018 -0400",
                "to": 1527170440388,
                "to_as_string": "Thu May 24 10:00:40 2018 -0400",
                "doc_count": 4511,
                "total_count": {
                  "value": 35550
                }
              }
            }
          }
        },
        {
          "key": "QuickView",
          "doc_count": 418928,
          "range": {
            "buckets": {
              "earlier": {
                "from": 1527163240388,
                "from_as_string": "Thu May 24 08:00:40 2018 -0400",
                "to": 1527166840388,
                "to_as_string": "Thu May 24 09:00:40 2018 -0400",
                "doc_count": 290,
                "total_count": {
                  "value": 312
                }
              },
              "latest": {
                "from": 1527166840388,
                "from_as_string": "Thu May 24 09:00:40 2018 -0400",
                "to": 1527170440388,
                "to_as_string": "Thu May 24 10:00:40 2018 -0400",
                "doc_count": 398,
                "total_count": {
                  "value": 438
                }
              }
            }
          }
        }
      ]
    }
  }
}

```

I want to do something like this "diff\_count": latest.total\_count-earlier.total\_count

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [May 24, 2018, 3:18pm UTC](https://discuss.elastic.co/t/find-differenence-of-a-fields-from-2-bucket-values/133166/2 "2018-05-24T15:18:47Z")

</div>

Doing it with the `range` aggregation is going to be tricky/impossible, since they don't work with most pipeline aggs (see [#29250](https://github.com/elastic/elasticsearch/issues/29250)).

Instead, I'd use a DateHistogram with hourly interval, then a Derivative pipeline agg to find the difference between each subsequent bucket. If you _only_ want that two hour interval, you could limit the time range with a filter in the query. Or use the BucketSort pipeline agg to limit the data histogram to two buckets before doing the derivative.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2018, 3:18pm UTC](https://discuss.elastic.co/t/find-differenence-of-a-fields-from-2-bucket-values/133166/3 "2018-06-21T15:18:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.