@Sh3ldoris, Sorry for the initial confusing with the timelion.
Unfortunately Kibana doesn't fully support bucket_script aggregations yet. Here is the issue to track: https://github.com/elastic/kibana/issues/4707. But something is possible with TSVB.
I found this example and I think it should be possible in similar fashion to achieve your goal.
- Create a scripted field or reinvest you documents and add additional fields like:
dotStart: boolean; dotTimeout: boolean. - Use sum aggregation and them bucket script to subtract 2 sums. (Similar as described in Weighted Average in a DataTable of Kibana)
Maybe there is a simpler way, but, I think suggested way should also work.