# Kibana - Exclude field with same value

**URL:** https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127
**Category:** Kibana
**Created:** [April 20, 2017, 10:42pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127 "2017-04-20T22:42:33Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![chg](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chg](https://discuss.elastic.co/u/chg)
#### Post date: [April 20, 2017, 10:42pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/1 "2017-04-20T22:42:33Z")

</div>

I am trying to create a graph which displays deltas from the previous week and current week. In terms of delta, I would like to display the events that showed up last week, but not the current week AND the events that showed up this week, but not last week.

In each event there is an "ID" field. I would use the "ID" field to get the deltas. If there are duplicate ID's, these events would be omitted from the graph. I've looked into aggregated unique counts and json input, but could not find a solution. Any help would be appreciated.

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [April 21, 2017, 2:01pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/2 "2017-04-21T14:01:47Z")

</div>

@chg Unfortuantely, this isn't something that is currently supported. Elasticsearch has limited [Join support](https://www.elastic.co/guide/en/elasticsearch/reference/current/joining-queries.html) and neither of these types of joins appears to solve your problem, so Kibana isn't able to do so either.

---

<div class="post-metadata">

### Author: ![chg](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chg](https://discuss.elastic.co/u/chg)
#### Post date: [April 21, 2017, 4:15pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/3 "2017-04-21T16:15:15Z")

</div>

Thanks for the response Brandon. I was thinking of something along the lines of setting the date range to the current week and previous week, so I could look at only those events. And then somehow get a unique count of the ID's. If the count is greater than 1 for an ID, the event that contains that ID would be excluded. Is this possible to implement?

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [April 21, 2017, 4:30pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/4 "2017-04-21T16:30:40Z")

</div>

@chg it sounds like you're wanting to do custom excludes based on another query, which would require an unsupported Join.

---

<div class="post-metadata">

### Author: ![chg](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chg](https://discuss.elastic.co/u/chg)
#### Post date: [April 21, 2017, 9:35pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/5 "2017-04-21T21:35:20Z")

</div>

I was searching around and came upon scripted fields. Is there a way to generate a count and store in a scripted field? And then filter the events using the scripted field.

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [April 24, 2017, 10:51am UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/6 "2017-04-24T10:51:15Z")

</div>

@chg I'm not seeing how scripted fields would help you in this scenario. Elasticsearch/Kibana doesn't have a built-in mechanism to allow you to create scripted fields based on the counts in Elasticsearch.

---

<div class="post-metadata">

### Author: ![chg](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chg](https://discuss.elastic.co/u/chg)
#### Post date: [April 24, 2017, 3:56pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/7 "2017-04-24T15:56:12Z")

</div>

I see. Thanks @Brandon_Kobel for the reply.

---

<div class="post-metadata">

### Author: ![chg](https://avatars.discourse-cdn.com/v4/letter/c/f05b48/32.png) [@chg](https://discuss.elastic.co/u/chg)
#### Post date: [April 25, 2017, 11:00pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/8 "2017-04-25T23:00:37Z")

</div>

I came across the [bucket selector aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html), which seems to do what I want. But do you know if this feature is available in Kibana? I currently have version 4.6 installed and do not see this feature.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 23, 2017, 11:05pm UTC](https://discuss.elastic.co/t/kibana-exclude-field-with-same-value/83127/9 "2017-05-23T23:05:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
