# How to double count events?

**URL:** https://discuss.elastic.co/t/how-to-double-count-events/43125
**Category:** Elasticsearch
**Created:** [March 1, 2016, 2:55pm UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125 "2016-03-01T14:55:33Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sergeyb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sergeyb/32/5574_2.png) [@sergeyb](https://discuss.elastic.co/u/sergeyb)
#### Post date: [March 1, 2016, 2:55pm UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/1 "2016-03-01T14:55:33Z")

</div>

Not sure if this is possible, any help is greatly appreciated...

I have time-based events with two date fields: start time and end time.  
I'd like to count amount of active events at any given time, i.e. how many events were active every second. It means the same document should be counted several times if it lasted several seconds.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 2, 2016, 12:58am UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/2 "2016-03-02T00:58:12Z")

</div>

That's a tough one due to the nature of the event spanning multiple time buckets.

I can't immediately think of anything that could do this, but maybe someone else can.

---

<div class="post-metadata">

### Author: ![ddorian43](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddorian43/32/36093_2.png) [@ddorian43](https://discuss.elastic.co/u/ddorian43)
#### Post date: [March 2, 2016, 1:02am UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/3 "2016-03-02T01:02:14Z")

</div>

Make a script-thingy that returns an array of datetimes (say, 1 element for each day) and then do a group-by/aggregate-bucket on the whole array ?  
This way each document will have multiple-values, and it will be counted on several days.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 2, 2016, 6:18am UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/4 "2016-03-02T06:18:19Z")

</div>

Here is [a link](https://discuss.elastic.co/t/display-concurrency-in-data-on-kibana/26006/2) to a thread that discussed how to do something similar in Kibana using a scripted metrics aggregation. The aggregation example, which is based in start date and duration rather than start and end date, can be [found here](https://gist.github.com/jpountz/cebb8452648c36099cee).

---

<div class="post-metadata">

### Author: ![sergeyb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sergeyb/32/5574_2.png) [@sergeyb](https://discuss.elastic.co/u/sergeyb)
#### Post date: [March 2, 2016, 6:24am UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/5 "2016-03-02T06:24:02Z")

</div>

Thanks, worked like a charm 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:12pm UTC](https://discuss.elastic.co/t/how-to-double-count-events/43125/6 "2017-07-05T23:12:11Z")

</div>


