# How to combine two outputs

**URL:** https://discuss.elastic.co/t/how-to-combine-two-outputs/186905
**Category:** Kibana
**Created:** [June 21, 2019, 3:14pm UTC](https://discuss.elastic.co/t/how-to-combine-two-outputs/186905 "2019-06-21T15:14:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![frostkilen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frostkilen/32/48547_2.png) [@frostkilen](https://discuss.elastic.co/u/frostkilen)
#### Post date: [June 21, 2019, 3:14pm UTC](https://discuss.elastic.co/t/how-to-combine-two-outputs/186905/1 "2019-06-21T15:14:55Z")

</div>

Hi together,

as a total ES Noob I have one essential question.  
How do I combine two values from an aggregation?

I am collecting sFlow Data with "ElastiFlow" and have some traffic sums of  
the available fields (from sFlow) flow.dst\_addr and flow.src\_addr.

Generally my target is to see the overall traffic for lets say one IP address.  
What I have now: 1 value for ingress, one for egress.

Target:

1. Extract sum of flow.bytes for a range of IPs (total in AND out)
2. Put them into a table as visualization

I have absolutely now clue how to do that in combination. ☹

Could you point to the right direction?  
Thanks in advance 🙂

---

<div class="post-metadata">

### Author: ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)
#### Post date: [June 21, 2019, 10:25pm UTC](https://discuss.elastic.co/t/how-to-combine-two-outputs/186905/2 "2019-06-21T22:25:43Z")

</div>

If I'm understanding your requirements correctly, you should be able to do this with an IP range bucket aggregation and a Sum metric aggregation. Here's an example:

 ![26%20PM](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53511cc23b852bdb8a71fc6b02556bca7dcb747a.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2019, 10:25pm UTC](https://discuss.elastic.co/t/how-to-combine-two-outputs/186905/3 "2019-07-19T22:25:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
