# Summing values of similar fields in a time range

**URL:** https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812
**Category:** Kibana
**Created:** [May 24, 2021, 10:28am UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812 "2021-05-24T10:28:41Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Dna61](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@Dna61](https://discuss.elastic.co/u/Dna61)
#### Post date: [May 24, 2021, 10:28am UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812/1 "2021-05-24T10:28:41Z")

</div>

Hello,

I am shipping custom log data into Elasticsearch and my source data look like this:

> 1621805488 foo\_126 cpu 0.62  
> 1621805488 foo\_59 cpu 0.63  
> 1621805489 foo\_183 cpu 0.82  
> 1621805489 foo\_2 cpu 0.67  
> 1621805489 foo\_25 23316 cpu 0.77  
> 1621805489 foo\_189 cpu 0.80  
> 1621805489 foo\_245 cpu 0.75  
> 1621805688 foo\_126 cpu 0.62  
> 1621805688 foo\_59 cpu 0.63  
> 1621805689 foo\_183 cpu 0.82  
> 1621805689 foo\_2 cpu 0.67  
> 1621805689 foo\_25 cpu 0.77  
> 1621805689 foo\_189 cpu 0.80  
> 1621805689 foo\_245 cpu 0.75

I would like to be able to sum all the cpu values for all the fields named foo\_\* and display a per minute value in a kibana dashboard. what is the best way to do it?

---

<div class="post-metadata">

### Author: ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)
#### Post date: [May 25, 2021, 3:18am UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812/2 "2021-05-25T03:18:02Z")

</div>

Hi,  
First you have to make sure the field data you want to sum is on the right data type. You can't sum text right?

> [@Dna61](#):
>
> I would like to be able to sum all the cpu values for all the fields named foo\_\*

Assuming there are other value than `foo*` on `your_field`, then you have to query only the `foo*`, create a save search on discover and query it as `your_field : foo*`

ps: I'm not the best dashboard designer

use your created saved search as source  
you can use aggregation based \> line chart, as it will show the value growth

1. for the Y-Axis choose the `sum` Aggregation
2. add X-Axis and choose the `Date Histogram` Aggregation, choose the desired time field , set the minimum interval to `Minute`

I would like to know the feedback 🙂

---

<div class="post-metadata">

### Author: ![Dna61](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@Dna61](https://discuss.elastic.co/u/Dna61)
#### Post date: [May 25, 2021, 9:31am UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812/3 "2021-05-25T09:31:15Z")

</div>

Thanks Charles, but that did not work. i had a bit of progress with timelion using:

```auto
    .es(index=myindex*,timefield=timestamp,metric=sum:foo_126_cpu,interval=1m)

    .sum(.es(index=myindex*,timefield=timestamp,metric=sum:foo_59_cpu,interval=1m))

    .sum(.es(index=myindex*,timefield=timestamp,metric=sum:foo_183_cpu,interval=1m))

```

however to make the code better I would have preferred to have a wildcard in the metric field. something like: foo\_\*\_cpu

it seems to be not supported or am i missing something.

---

<div class="post-metadata">

### Author: ![charles97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles97/32/79243_2.png) [@charles97](https://discuss.elastic.co/u/charles97)
#### Post date: [May 25, 2021, 1:18pm UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812/4 "2021-05-25T13:18:25Z")

</div>

It is working with me.  
Seems you've answered your own question.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2021, 1:18pm UTC](https://discuss.elastic.co/t/summing-values-of-similar-fields-in-a-time-range/273812/5 "2021-06-22T13:18:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
