# How to subtract two values in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [July 12, 2020, 8:24am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824 "2020-07-12T08:24:48Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![adi0509](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@adi0509](https://discuss.elastic.co/u/adi0509)\ **Post date:** [July 12, 2020, 8:24am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/1 "2020-07-12T08:24:48Z")
if my logs looks like this, { name: "A1",X: 10} { name: "A1",Y: 8 } { name: "A2",X: 15} { name: "A2",Y: 1 } then how can I subtract (X-Y) which have same name? What I want is, for name "A1" X-Y = 10-8 = 2 for name "A2" X-Y = 15-1 = 14 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2020, 8:52am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/2 "2020-07-12T08:52:00Z")
You can not as it would mean joining documents, which Elasticsearch does not support. Instead try to merge these into a single document. ---
**Author:** ![adi0509](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@adi0509](https://discuss.elastic.co/u/adi0509)\ **Post date:** [July 12, 2020, 9:01am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/3 "2020-07-12T09:01:01Z")
All these logs are in same index ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2020, 9:03am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/4 "2020-07-12T09:03:28Z")
Does not matter. It has to be within the same document. ---
**Author:** ![adi0509](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@adi0509](https://discuss.elastic.co/u/adi0509)\ **Post date:** [July 12, 2020, 9:09am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/5 "2020-07-12T09:09:56Z")
how to merge it into single document? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 12, 2020, 9:26am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/6 "2020-07-12T09:26:24Z")
Do that when you are indexing data. Exact how will depend on your use case. ---
**Author:** ![adi0509](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@adi0509](https://discuss.elastic.co/u/adi0509)\ **Post date:** [July 13, 2020, 6:38am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/7 "2020-07-13T06:38:40Z")
can you share any link for that? I am using fluentd to send logs to elasticsearch. I was trying scripted field in kibana, but it didn't work. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 13, 2020, 6:41am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/8 "2020-07-13T06:41:02Z")
You will need to combine documents or update the first document with the second. Not sure fluentd can do that. ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 13, 2020, 7:55am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/9 "2020-07-13T07:55:10Z")
Adarsh, > [@adi0509](#): > > how to merge it into single document? One way you can merge (with side effects) is by making "name" field as \_id and X / Y as fields. You can use script processor to compute (X-Y) at ingest time or use scripted\_fields to compute at query time. Note that as your index grows, your ingestion throughput will suffer badly. Your data may not distribute evenly. If there are other fields in the index, design may affect other queries. Doing it from outside ES will require tool to deal with optimistic concurrency control (if\_seq\_no or if\_primary\_term). Read document with name = A update if\_seq\_no = X. If document not found use create instead of update. This too will slow down ingestion. ---
**Author:** ![Hendrik\_Muhs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendrik_muhs/32/25802_2.png) [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)\ **Post date:** [July 13, 2020, 10:00am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/10 "2020-07-13T10:00:01Z")
Fixing at ingest is still be best solution, however if it's not possible to get both values in 1 document, but you can't avoid having 2, you can use [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) to pivot the index and calculate what you need. With transform you can `group_by` documents by `name` and e.g. use a `scripted_metric` aggregation to get `X` and `Y` and calculate `X-Y`. I do not have a concrete working example at hand, but the [examples](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-painless-examples.html) should be helpful to craft something. ---
**Author:** ![adi0509](https://avatars.discourse-cdn.com/v4/letter/a/898d66/32.png) [@adi0509](https://discuss.elastic.co/u/adi0509)\ **Post date:** [July 13, 2020, 10:36am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/11 "2020-07-13T10:36:23Z")
Thanks everyone!! Finally did that by merging logs by names using fluentd concat plugin: > > > My service log is like this, that one id will match two records > 2018-10-10 unique\_id\_01 start > 2018-10-10 unique\_id\_02 start > 2018-10-10 unique\_id\_01 stop success > 2018-10-10 unique\_id\_02... and then send the logs elasticsearch. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 10, 2020, 10:47am UTC](https://discuss.elastic.co/t/how-to-subtract-two-values-in-elasticsearch/240824/12 "2020-08-10T10:47:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.