Kibana scripted fields update by elasticsearch query

Elastic Stack Kibana
1

Hello,

I am wondering if it's possible to create a scripted field by subtracting a field value from the resulted from an elasticsearch query.

Regards,
Peter

2

Hi @zozo6015,

Can you give me a bit more detail? Here is a good blog that may help:

Thanks,
Liza

3

I have an index with with some fields that has a cumulative values added up for each day. So if each day increases I would like to get a scripted field of the difference between day1 and day2. So I was thinking if it's possible to use a query in the elasticsearch in a scripted field script for @timestamp-1d and get the data of the field for the previous day then I would just do a subtraction of current day .value - the value got from the elasticsearch query.

I am not sure if that is possible since as far as I read the scripted fields works only on curent document.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.