# Percentages per day (per bucket) possible?
**URL:** https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138
**Category:** Kibana
**Created:** [November 15, 2019, 9:27pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138 "2019-11-15T21:27:52Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Skeeve](https://discuss.elastic.co/u/Skeeve)
#### Post date: [November 15, 2019, 9:27pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/1 "2019-11-15T21:27:53Z")
I have a set of records where each record has (among other fields) a field "spam" for the amount of spam mails received and a field "total\_volume" for the amount of mails, received. For each day I have several entries for different mailboxes.
So the data looks something like this:
```
POST _bulk
{ "index":{"_index":"test"}}
{ "spam":1, "total_volume": 2, "mailbox": "mb1", "date":"2019-01-01"}
{ "index":{"_index":"test"}}
{ "spam":1, "total_volume": 100, "mailbox": "mb2", "date":"2019-01-01"}
{ "index":{"_index":"test"}}
{ "spam":2, "total_volume": 2, "mailbox": "mb1", "date":"2019-01-02"}
{ "index":{"_index":"test"}}
{ "spam":2, "total_volume": 100, "mailbox": "mb2", "date":"2019-01-02"}
```
I'd like to get a visualization which would show me about 2% for 2019-01-01 and about 4% for 2019-01-02.
What I could achieve, using JSON input
```
{
"script": {
"lang": "painless",
"inline": "_value * 100 / doc['total_volume'].value"
}
}
```
was the average per day, but this results in too high values. For example on 2019-01-01 the high rate of mb1 (50%) is averaged with the 1% of mb2.
So the result is 25.5% for 2019-01-01 and 51% for 2019-01-02 instead of the required 2% and 4%.
I have no clue how I could achieve this.
Example what I used to get the results as a table:
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [November 18, 2019, 9:08pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/2 "2019-11-18T21:08:14Z")
You can try with TSVB and the Math aggregation. Then you should be able to calculate the percentage of spam as "100 \* sum(spam)/sum(total\_volume)".
Basically create 2 sum metrics, one for spam, one for total\_volume.
Then create a math aggregation with the equivalent of the formula that I added above, and then keep just this line visible on the chart.
PS: don't forget to keep the bucket size to 1d.
---
### Author:  [@Skeeve](https://discuss.elastic.co/u/Skeeve)
#### Post date: [November 19, 2019, 6:43am UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/3 "2019-11-19T06:43:19Z")
Thanks for that hint. I already tried it and tried again now. I get a strange error message
`[tsvb] > No reason phrase`
---
### Author:  [@Skeeve](https://discuss.elastic.co/u/Skeeve)
#### Post date: [November 19, 2019, 6:59am UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/4 "2019-11-19T06:59:14Z")
It gets weird now…
If I put as Expression `add(multiply(params.sum_spam,100) , params.sum_total)` I get a graph.
If I replace "add" with "divide" =\> No data to display…
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [November 19, 2019, 12:49pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/5 "2019-11-19T12:49:26Z")
can you try with mathematical signs instead of the functions?
---
### Author:  [@Skeeve](https://discuss.elastic.co/u/Skeeve)
#### Post date: [November 19, 2019, 1:36pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/6 "2019-11-19T13:36:35Z")
Made no difference, but I managed to solve the issue by using "Bucket script" instead of "Math".
So issue solved thanks to your hints.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2019, 1:36pm UTC](https://discuss.elastic.co/t/percentages-per-day-per-bucket-possible/208138/7 "2019-12-17T13:36:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.