# Sum of average metrics

**URL:** <https://discuss.elastic.co/t/sum-of-average-metrics/233534>\
**Category:** Elasticsearch\
**Created:** [May 20, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sum-of-average-metrics/233534 "2020-05-20T12:30:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vbohata](https://avatars.discourse-cdn.com/v4/letter/v/a8b319/32.png) [@vbohata](https://discuss.elastic.co/u/vbohata)\
**Post date:** [May 20, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sum-of-average-metrics/233534/1 "2020-05-20T12:30:03Z")

</div>

I have following data:

```auto
source | processed_by_logstash | rate_15m
filebeat1 | logstash1 | 10
filebeat1 | logstash2 | 20.5
filebeat2 | logstash1 | 20.1
filebeat2 | logstash2 | 20.6

```

The source is the system/agent sending the logs, processed\_by\_logstash stores the logstash name which processed the logs, rate\_15m is the rate per sec during last 15 minutes.

I want to know the rates per source - in this case 30.5 for filebeat1, 40.7 for filebeat2. How to get these values? I am able to use multiple aggregations to get average of rate\_15m values for each source/processed\_by\_logstash combination, but in this case the value is 1/2 half of what I want. Also the number of processed\_by\_logstash per source changes, so I can not simple multiply the result by 2.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2020, 12:32pm UTC](https://discuss.elastic.co/t/sum-of-average-metrics/233534/2 "2020-06-17T12:32:15Z")

</div>

Closed on June 17, 2020, 12:32pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
