# How to show difference (increase/decrease) between today and yesterday for each host **URL:** \ **Category:** Kibana\ **Created:** [February 23, 2017, 4:17pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262 "2017-02-23T16:17:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![inouk](https://avatars.discourse-cdn.com/v4/letter/i/87869e/32.png) [@inouk](https://discuss.elastic.co/u/inouk)\ **Post date:** [February 23, 2017, 4:17pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262/1 "2017-02-23T16:17:20Z")
Hi, I'm tring to show hard drive space usage increase for each host, I mean, the top 5 hosts that has the highest increase of space usage. Here's what I did: .es(index='collectd-_', metric='sum:lunused', q='server:?ds_').subtract(.es(index='collectd-_', metric='sum:lunused', q='server:?ds_', offset=-1d)) It shows an aggregation of consumption of hard drive space usage, each day. However, I would like to show the TOP 5 of space increase for each host, I tried this: .es(index='collectd-_', metric='sum:lunused', q='server:?ds_', split='host:5').subtract(.es(index='collectd-_', metric='sum:lunused', q='server:?ds_', offset=-1d, split='host:5')) However, I'm getting this error: Timelion: Error: in cell #5: argument must be a seriesList with a single series So, I tried this: .es(index='collectd-_', metric='sum:lunused', q='server:?ds_', split='host:5').subtract(.es(index='collectd-_', metric='sum:lunused', q='server:?ds_', offset=-1d) But, the numbers aren't meaningful. How can I show the top 5 hosts that has the highest increase of space usage? Thank you! ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [February 24, 2017, 9:21pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262/2 "2017-02-24T21:21:53Z")
Hey Joey, After speaking with one of our resident Timelion experts, I learned that in order for Elasticsearch to compute top 5 hosts that have the highest increase in disk usage, we'd need a pipeline aggregation, and bucket aggregations can't be sorted by pipelines. Pipelines are computed on the coordinating node after the aggregation phase, and Elasticsearch can't do multi-phase search/aggregation yet. So, to answer your question, neither Timelion nor Elasticsearch can do what you're asking for.... yet. Sorry, hope this helps! CJ ---
**Author:** ![inouk](https://avatars.discourse-cdn.com/v4/letter/i/87869e/32.png) [@inouk](https://discuss.elastic.co/u/inouk)\ **Post date:** [February 27, 2017, 3:41pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262/3 "2017-02-27T15:41:31Z")
Hi, Thank you for your reply. So I guess that the partial workaround is to add a new field, a daily percent increase in Logstash. Thank you! ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [February 27, 2017, 6:04pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262/4 "2017-02-27T18:04:13Z")
Thanks for posting a workaround, Joey! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 27, 2017, 6:04pm UTC](https://discuss.elastic.co/t/how-to-show-difference-increase-decrease-between-today-and-yesterday-for-each-host/76262/5 "2017-03-27T18:04:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.