Is it possible to divide value in one column with value in another column, in Kibana table visualization?

Hi,

I am using ELK GA 5.0.0. I have managed to create a table like below;

---------------------------------------------
| User_Name  |  Sum_of_ColA  |  Sum_of_ColB |
-------------+---------------+---------------
| UserA      |  20           |  10          |
| UserB      |  15           |  3           |
---------------------------------------------

I have 2 fields in my index ColA and ColB.The 2 columns in my table shows sum of values in those fields. I have splitted rows using User_Name field.

I want to create another column, which is Sum_of_ColA/Sum_of_ColB like below;

-------------------------------------------------------
| User_Name  |  Sum_of_ColA  |  Sum_of_ColB |  Ratio  |
-------------+---------------+--------------+----------
| UserA      |  20           |  10          |  2      |
| UserB      |  15           |  3           |  5      |
-------------------------------------------------------

Is this possible? Thanks in advance..

You can use scripted fields to do so , this is how you can create the same
ratio = doc['Sum_of_ColA'].value / doc['Sum_of_ColB'].value

Moreover you can refer below docs:
https://www.elastic.co/guide/en/kibana/current/scripted-fields.html

@Prashant_Agrawal those 2 columns are calculated (sum) fields. Will scripted field work with that?

You mean sum is not being stored as data , rather it is calculated as sum (colA) ?

Yes. Its getting calculated for table.

I don't think we have any option to do same under data table. Probably you can use timelion for same , where you can write a match function something like sum(A) / sum(B)

Hi @elasticcloud,

for a table generated via an aggregation that is not possible right now. The required functionality in aggregations equivalent to the scripted field suggested above would be a bucket script aggregation which is not supported by Kibana yet.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.