# How to get the diff value of 2 fields and set it to a new field

**URL:** https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801
**Category:** Beats
**Tags:** filebeat
**Created:** [June 14, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801 "2021-06-14T07:43:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![kwoxer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kwoxer/32/74809_2.png) [@kwoxer](https://discuss.elastic.co/u/kwoxer)
#### Post date: [June 14, 2021, 7:43am UTC](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801/1 "2021-06-14T07:43:41Z")

</div>

I want to reference a field in FileBeat to calculate the difference between them.

```auto
  - dissect:
      tokenizer: '"%{licence}","%{system}","%{part}","%{uses|integer}","%{users|integer}"'
      field: "message"
      target_prefix: "data"
  - add_fields:
      target: data
      fields:
        name: %{data.uses} - %{data.users}

```

But that config is not allowed.

As Scripted field are deprecated, how should I solve this issue now?

I cannot find any solution in the forum. What is the best best to get the diff of 2 fields?

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [June 14, 2021, 8:30am UTC](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801/2 "2021-06-14T08:30:08Z")

</div>

Hi @kwoxer!

Maybe you can use [`script-processor`](https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html) for this.

C.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2021, 10:30am UTC](https://discuss.elastic.co/t/how-to-get-the-diff-value-of-2-fields-and-set-it-to-a-new-field/275801/3 "2021-07-12T10:30:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.