# Timelion - subtract by split data field (group per field before operation)

**URL:** <https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [January 4, 2018, 10:05pm UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180 "2018-01-04T22:05:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![eurobosch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eurobosch/32/26259_2.png) [@eurobosch](https://discuss.elastic.co/u/eurobosch)\
**Post date:** [January 4, 2018, 10:05pm UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180/1 "2018-01-04T22:05:07Z")

</div>

Just found out I have this great tool for time-series in Kibana for ES timed data and would like to analyse through \>1M of the following doc type per `MarketName` field:

```auto
{
			"MarketName" : "BTC-XRP",
			"High" : 0.00000919,
			"Low" : 0.00000820,
			"Volume" : 74339.61396015,
			"Last" : 0.00000820,
			"BaseVolume" : 0.64966963,
			"TimeStamp" : "2014-07-09T07:19:30.15",
			"Bid" : 0.00000820,
			"Ask" : 0.00000831,
			"OpenBuyOrders" : 15,
			"OpenSellOrders" : 15,
			"PrevDay" : 0.00000821,
			"Created" : "2014-03-20T06:00:00",
			"DisplayMarketName" : null
		}

```

I have time-series data for 200 `MarketNames` for _each_ point in time and would like to perform operations _per this field_, like subtraction, division, followed by 1st and 2nd degree derivatives, mvavg's, etc as per Rashid's videos 🙂

My intention is to use this time series to compute **per** `MarketName` data in scenarios such as:

`BaseVolume - BaseVolume(offset=-1d)` or  
`OpenBuyOrders - OpenSellOrders`, all per the same _MarketName_

Basically I intend to use the split in the subtracted datasource by the same field, such as:

`.es(metric=max:BaseVolume, split=MarketName:10).subtract(.es(metric=max:BaseVolume, offset=-1d, split=MarketName:10))` (notice the split in the subtract) which, of course, is not working.

Now, I was wondering:

1. what kind of aggregation should I use to split the data by `MarketName` after (or even before) an operation?
2. if I use the split in the first data source, it will subtract the entire series from the per Market data
3. should I use some other aggregations of ES before using TimeLion to achieve this kind of calculations?
4. which would be the recommended way to perform such operations on "multidimensional" data?
5. if I perform the subtract, is it correct to split after creating a group, if possible?

My intent is to have graphs sorted by the result of such operations (subtract, sum/divide, etc) applied for each MarketName and display/graph the first N results (as split does) but my brain is stuck on bucketing/aggregating the data.

Any suggestion will be greatly appreciated as I struggled without any success in the past couple of days.

Thanks in advance for any advice!

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [January 8, 2018, 11:27am UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180/2 "2018-01-08T11:27:01Z")

</div>

Hi @eurobosch,

applying the arithmetic operations to multiple series will be supported starting with Kibana 6.2 (see [GitHub PR #14891](https://github.com/elastic/kibana/pull/14891)). Sorry to hear you had to struggle with this and thanks for the detailed description of your use-case.

---

<div class="post-metadata">

**Author:** ![eurobosch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eurobosch/32/26259_2.png) [@eurobosch](https://discuss.elastic.co/u/eurobosch)\
**Post date:** [January 9, 2018, 3:58pm UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180/3 "2018-01-09T15:58:42Z")

</div>

Thanks for the good news, @weltenwort, looking forward for the new version: I looked in the PR and it's exactly what I need! Worried though that I have to upgrade from 5.5 🙂

Any idea what's the 6.2 release date?

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [January 9, 2018, 4:32pm UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180/4 "2018-01-09T16:32:28Z")

</div>

I can't give you a specific date 😇, but given our release timings it should be within the next two months. 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2018, 4:32pm UTC](https://discuss.elastic.co/t/timelion-subtract-by-split-data-field-group-per-field-before-operation/114180/5 "2018-02-06T16:32:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.