Scripted field for same month data

[Gauti (Gautham)]

Hi All,

We are trying to build a dashboard for a new scenario,like we are ingesting data from servicenow using logstash, the data has ticket information like opened and closed, we want to build a dashboard for monthly backlog tickets, which is tickets opened and not closed on the same month.

Trying to writing a scripted field to identify this, but not able to, can someone guide me how can i achieve this.

logic we are trying is, if "created month" and "closed month" are same then return 0 else return 1

Thanks
Gautham

[Hendrik_Muhs]

Are the fields part of the same or different documents?

[Gauti (Gautham)]

@Hendrik_Muhs Fields are from same documents.

[Hendrik_Muhs]

You can use a script as part of the aggregation you are looking for, e.g. sum. The script is applied per data point, therefore if you return 1 if and only if your criteria is met you get the total count the criteria was met. Vice versa you can create another sum aggregation with reversed logic.