How to sum field?

I've got many docs in elasticsearch and I want to sum the field Verspätung by the field Linie.
When I say Kibana to sum the Verspätung , it sums all Verspätung fields of result. So I got following :

Linie          Sum_verspätung
S5              82
EC218           82

But I want the following.

Linie          Sum_verspätung
S5             76
EC218           6

My docs in ES look like this:

Example doc1:

{
"@old_timestamp" => "2020-01-09T1346",
"result" => [
[ 0] {
"Verspätung" => 3,
"Linie" => "EC218",
"ID" => "2020-01-09T14:04:00.000Z_8010101"
},
[ 1] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 56,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006698",
}
[ 2] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 10,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006556",
}

Example doc2:

{
"@old_timestamp" => "2020-01-09T1386",
"result" => [
[ 0] {
"Verspätung" => 3,
"Linie" => "EC218",
"ID" => "2020-01-09T14:04:00.000Z_8010101"
},
[ 1] {
"Bahntyp" => "S-Bahn",
"Verspätung" => 10,
"Linie" => "S5",
"ID" => "2020-01-09T14:48:00.000Z_8006698",
}

I don't understand it properly your question.
but if "Verspätung" is integer then
you should have 3+56+10+3+10 = 82 (which is correct thing)
and Linie is string you can't sum it.

I want to sum the Verspätung values by the different Linie and not all
Verspätung values of one doc.

then you do sum for value verspatung.
and then use term filter on Linie

Not sure exactly where you're trying to do this, but you can create this table in with the "Data Table" visualization in Kibana.

The configuration should look like this:

  • Under "Metrics" expand the existing count Metric
  • On the "Aggregation" drop down select "Sum"
  • Under the "Field" drop down select "Verspätung"
  • Under the "Buckets" section, click "Add" and then select "Split rows"
  • On the "Aggregation" drop down select "Terms"
  • On the "Field" drop down select "Linie"
  • Change the "Size" option to the number of results you want to look at

Let me know if this doesn't work!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.