How to sum field?

Elastic Stack Kibana
1

I've got many docs in elasticsearch and I want to sum the field Verspätung by the field Linie.
When I say Kibana to sum the Verspätung , it sums all Verspätung fields of result. So I got following :

Linie          Sum_verspätung
S5              82
EC218           82

But I want the following.

Linie          Sum_verspätung
S5             76
EC218           6

My docs in ES look like this:

Example doc1:

{
"@old_timestamp" => "2020-01-09T1346",
"result" => [
[ 0] {
"Verspätung" => 3,
"Linie" => "EC218",
"ID" => "2020-01-09T14:04:00.000Z_8010101"
},
[ 1] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 56,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006698",
}
[ 2] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 10,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006556",
}

Example doc2:

{
"@old_timestamp" => "2020-01-09T1386",
"result" => [
[ 0] {
"Verspätung" => 3,
"Linie" => "EC218",
"ID" => "2020-01-09T14:04:00.000Z_8010101"
},
[ 1] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 10,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006698",
}

2

I don't understand it properly your question.
but if "Verspätung" is integer then
you should have 3+56+10+3+10 = 82 (which is correct thing)
and Linie is string you can't sum it.

3

I want to sum the Verspätung values by the different Linie and not all
Verspätung values of one doc.

4

then you do sum for value verspatung.
and then use term filter on Linie

5

Not sure exactly where you're trying to do this, but you can create this table in with the "Data Table" visualization in Kibana.

The configuration should look like this:

  • Under "Metrics" expand the existing count Metric
  • On the "Aggregation" drop down select "Sum"
  • Under the "Field" drop down select "Verspätung"
  • Under the "Buckets" section, click "Add" and then select "Split rows"
  • On the "Aggregation" drop down select "Terms"
  • On the "Field" drop down select "Linie"
  • Change the "Size" option to the number of results you want to look at

Let me know if this doesn't work!