# Kibana - Filter data where sum of field 1 \> sum of field 2
**URL:** https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592
**Category:** Kibana
**Created:** [December 29, 2017, 12:58pm UTC](https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592 "2017-12-29T12:58:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@PedroMarques](https://discuss.elastic.co/u/PedroMarques)
#### Post date: [December 29, 2017, 12:58pm UTC](https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592/1 "2017-12-29T12:58:20Z")
Hello.
I'm trying to visualize terms of my data in a bar graph, showing two bars: one for the sum of src\_bytes and one for the sum of dst\_bytes. It is also important to order the terms based on the total number of bytes, which I have done.
However, I would also like to filter the terms where the total sum of src\_bytes is greater than the total sum of dst\_bytes and vice versa. How can I apply such a filter.
Thank you.
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [December 29, 2017, 1:50pm UTC](https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592/2 "2017-12-29T13:50:05Z")
Hello,
You can usually achieve that filter by creating a scripted field that is equal to the difference between src\_bytes and dst\_bytes. But this depends on how your data is structured and how you’ve achieved the first step from your question.
Can you give me some more details on the aggregations that you used to create the bar chart with the sums of src and dst bytes, per term?
Also, an example of a document that contains src\_bytes and/or dst\_bytes would be of use in order to help you create that scripted field.
---
### Author:  [@PedroMarques](https://discuss.elastic.co/u/PedroMarques)
#### Post date: [December 30, 2017, 9:35am UTC](https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592/3 "2017-12-30T09:35:40Z")
My data looks like this:
{src\_bytes: 10, dst\_bytes: 20, total\_bytes: 30, username: Joe}
I'm doing a basic bar graph, aggregating usernames on the X axis, and showing just two metrics: sum of src\_bytes and sum of dst\_bytes.
I created the scripted field, of the difference between src\_bytes and dst\_bytes, and used that to order the usernames in my graph. By ordering it in descending order I was able to show the usernames which had the highest percentage of src\_bytes vs dst\_bytes, which is close to what I'm looking for.
How can I now use the scripted field to actually filter all usernames which have a sum of "bytes\_difference" less than zero ?
As an aside, because I already need to parse my data for other reasons, I will be able to add "bytes\_difference" directly into the documents themselves, instead of making use of a scripted field. Is there some other data that I could add to the documents themselves that would help with this problem ?
Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2018, 9:39am UTC](https://discuss.elastic.co/t/kibana-filter-data-where-sum-of-field-1-sum-of-field-2/113592/4 "2018-01-27T09:39:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.