Kibana scripted fields update by elasticsearch query


I am wondering if it's possible to create a scripted field by subtracting a field value from the resulted from an elasticsearch query.


Hi @zozo6015,

Can you give me a bit more detail? Here is a good blog that may help:


I have an index with with some fields that has a cumulative values added up for each day. So if each day increases I would like to get a scripted field of the difference between day1 and day2. So I was thinking if it's possible to use a query in the elasticsearch in a scripted field script for @timestamp-1d and get the data of the field for the previous day then I would just do a subtraction of current day .value - the value got from the elasticsearch query.

I am not sure if that is possible since as far as I read the scripted fields works only on curent document.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.