Kibana scripted fields update by elasticsearch query

[zozo6015 (Peter)]

Hello,

I am wondering if it's possible to create a scripted field by subtracting a field value from the resulted from an elasticsearch query.

Regards,
Peter

[LizaD (Liza Dayoub)]

Hi @zozo6015,

Can you give me a bit more detail? Here is a good blog that may help:

Using Painless in Kibana scripted fields

Thanks,
Liza

[zozo6015 (Peter)]

I have an index with with some fields that has a cumulative values added up for each day. So if each day increases I would like to get a scripted field of the difference between day1 and day2. So I was thinking if it's possible to use a query in the elasticsearch in a scripted field script for @timestamp-1d and get the data of the field for the previous day then I would just do a subtraction of current day .value - the value got from the elasticsearch query.

I am not sure if that is possible since as far as I read the scripted fields works only on curent document.