Summ of two buckets

I'm using Kibana to show a particular metric for data collected from a local SIP device. My data is indexed like this:

  "_index": "calls",
  "_type": "_doc",
  "_id": "0ysOqHgBtkTNQGR8TH85",
  "_version": 1,
  "_score": null,
  "_source": {
    "timestamp": "1617727201",
    "gateway": "gate1.usuario1.01",
    "@timestamp": "2021-04-06T16:40:10.094Z",
    "@version": "1",
    "activecalls": 14,
    "log": {
      "file": {
        "path": "/var/log/metricas/outbound.activecalls"
    "@fecha_exe": "2021-04-06T16:40:01.000Z",
    "message": "2021 Apr 6 12:40:01;1617727201;usuario1,gate1.usuario1.01,14;usuario1,gate2.usuario1.02,30;user2,gw.01,0;user2,gw.02,7",
    "data": "usuario1,gate1.usuario1.01,14",
    "fields": {
      "type": "outbound-activecalls"
    "fecha": "2021 Apr 6 12:40:01",
    "usuario": "usuario1",
    "input": {},
    "tags": [
    "agent": {
      "name": "eksdata"
    "ecs": {},
    "host": {
      "name": "eksdata"
  "fields": {
    "@timestamp": [
    "@fecha_exe": [
  "sort": [

So, the important fields are : "usuario", "activecalls", "gateway" and "fields.type"
I need to show a metric wich has the summ of "activecalls" (avg) for a particular user, including the "inbound" and "outbound" type of calls for all the far i was able to use a "metric" type visualization but i only can get the values per "inbound" and "outbound".. is there a way to summ this two values in a metric visualization???
These are screenshots for the configuration i used for the latter:

img1 img2 img3

And this is the result:

But i need those two values added.

is there a way to have this?.. even if i can do it with a Time Series Visualization...

What about a scripted field?

Thanks @AClerk for the idea....
I'm not an "advance" user in Kibana and Elasticsearch, so i wonder how can i use the "scripted field" in the visualization... let's asumme i have the two values as indicated in the visualization metric above... how can I use the scripted field inside this metric visualization? or maybe the approach is other?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.