# Summ of two buckets

**URL:** <https://discuss.elastic.co/t/summ-of-two-buckets/269366>\
**Category:** Kibana\
**Created:** [April 6, 2021, 5:48pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366 "2021-04-06T17:48:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmartinez.rv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rmartinez.rv/32/86414_2.png) [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\
**Post date:** [April 6, 2021, 5:48pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366/1 "2021-04-06T17:48:31Z")

</div>

Hi.  
I'm using Kibana to show a particular metric for data collected from a local SIP device. My data is indexed like this:

```
{
  "_index": "calls",
  "_type": "_doc",
  "_id": "0ysOqHgBtkTNQGR8TH85",
  "_version": 1,
  "_score": null,
  "_source": {
    "timestamp": "1617727201",
    "gateway": "gate1.usuario1.01",
    "@timestamp": "2021-04-06T16:40:10.094Z",
    "@version": "1",
    "activecalls": 14,
    "log": {
      "file": {
        "path": "/var/log/metricas/outbound.activecalls"
      }
    },
    "@fecha_exe": "2021-04-06T16:40:01.000Z",
    "message": "2021 Apr 6 12:40:01;1617727201;usuario1,gate1.usuario1.01,14;usuario1,gate2.usuario1.02,30;user2,gw.01,0;user2,gw.02,7",
    "data": "usuario1,gate1.usuario1.01,14",
    "fields": {
      "type": "outbound-activecalls"
    },
    "fecha": "2021 Apr 6 12:40:01",
    "usuario": "usuario1",
    "input": {},
    "tags": [
      "beats_input_codec_plain_applied"
    ],
    "agent": {
      "name": "eksdata"
    },
    "ecs": {},
    "host": {
      "name": "eksdata"
    }
  },
  "fields": {
    "@timestamp": [
      "2021-04-06T16:40:10.094Z"
    ],
    "@fecha_exe": [
      "2021-04-06T16:40:01.000Z"
    ]
  },
  "sort": [
    1617727201000
  ]
}

```

So, the important fields are : "usuario", "activecalls", "gateway" and "fields.type"  
I need to show a metric wich has the summ of "activecalls" (avg) for a particular user, including the "inbound" and "outbound" type of calls for all the gateways......so far i was able to use a "metric" type visualization but i only can get the values per "inbound" and "outbound".. is there a way to summ this two values in a metric visualization???  
These are screenshots for the configuration i used for the latter:

![img1](https://us1.discourse-cdn.com/elastic/original/3X/8/1/81f4480a575ffaea7579cf630f6cada67cb02222.jpeg) ![img2](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54fec90c24977e2fd2c496410bba3df2fa354a05.jpeg) ![img3](https://us1.discourse-cdn.com/elastic/original/3X/3/7/378774659ec86a7814b619ee6abc3d8d9f87533f.jpeg)

And this is the result:

 ![result](https://us1.discourse-cdn.com/elastic/original/3X/9/3/93365e75fed3f326bb6eaf4482d8ee491e53bd3c.jpeg)

But i need those two values added.

is there a way to have this?.. even if i can do it with a Time Series Visualization...  
Thanks!  
Ricardo

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [April 7, 2021, 12:26am UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366/2 "2021-04-07T00:26:52Z")

</div>

What about a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html)?

---

<div class="post-metadata">

**Author:** ![rmartinez.rv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rmartinez.rv/32/86414_2.png) [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\
**Post date:** [April 7, 2021, 3:18pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366/3 "2021-04-07T15:18:51Z")

</div>

Thanks @AClerk for the idea....  
I'm not an "advance" user in Kibana and Elasticsearch, so i wonder how can i use the "scripted field" in the visualization... let's asumme i have the two values as indicated in the visualization metric above... how can I use the scripted field inside this metric visualization? or maybe the approach is other?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2021, 3:19pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366/4 "2021-05-05T15:19:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.