# Transforms group by on 2 different data fields having same value

**URL:** <https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478>\
**Category:** Kibana\
**Tags:** transforms\
**Created:** [June 20, 2023, 12:19pm UTC](https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478 "2023-06-20T12:19:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashwani\_perf](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@ashwani\_perf](https://discuss.elastic.co/u/ashwani_perf)\
**Post date:** [June 20, 2023, 12:19pm UTC](https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478/1 "2023-06-20T12:19:03Z")

</div>

Hi Team,

I am fairly new to Kibana and have run into a problem. I am trying to write a single transform which captures ingress and egress of a single event so that i can aggregate them by timestamp max and min and then calculate the time difference using data views.

However the problem is the group by data field at the ingress and egress which I generally use to pick the right entry and exit. In my case the values are same but the data field name is different.

e.g json.city.id : London and json.event.message.headers.city-id : London

Now since they are appearing with different name and using it under group by and then trying aggregating at timestamp.max and timestamp.min is not actually working. I am getting same timestamp min and max value as they appear to be taken from either entry or exit but not from both

---

<div class="post-metadata">

**Author:** ![Hendrik\_Muhs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendrik_muhs/32/25802_2.png) [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)\
**Post date:** [June 20, 2023, 1:08pm UTC](https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478/2 "2023-06-20T13:08:48Z")

</div>

Have a look at runtime fields, you can create a runtime field that either takes `json.city.id` or ` json.event.message.headers.city-id` depending on what is set.

---

<div class="post-metadata">

**Author:** ![ashwani\_perf](https://avatars.discourse-cdn.com/v4/letter/a/e19b73/32.png) [@ashwani\_perf](https://discuss.elastic.co/u/ashwani_perf)\
**Post date:** [June 20, 2023, 1:34pm UTC](https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478/3 "2023-06-20T13:34:43Z")

</div>

Thanks @Hendrik_Muhs for coming back so quickly. I am a but naive in this area i can spot the runtime field editor in the transform but is it possible at all to post any sample please ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2023, 1:35pm UTC](https://discuss.elastic.co/t/transforms-group-by-on-2-different-data-fields-having-same-value/336478/4 "2023-07-18T13:35:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.