Trying to aggregate data backwards in time

[dorj1234 (Dor Juravski)]

Hi, not sure if this is possible in Kibana, or even using Logstash.
I am looking for a way to see how many VMs I have added and removed in the past month/quarter.
Every day VMs records are kept. For each VM I keep a status "ADDED" or "REMOVED".

For example:
After day 1, I have 10 "documents" with status "REMOVED" and 5 with status "ADDED".
After day 2 I have the previous day count + today's count.

Now I am looking back at the last month, trying to summarize this count.
Any suggestions?

Thanks in advance !
JD

[ppisljar (Peter Pisljar)]

maybe i am over simplifying this, but isn't SUM(added) - SUM(removed) what you are looking for ?

[dorj1234 (Dor Juravski)]

Close. You are right it's simpler than I thought, just used 'count' instead of 'sum' and whatever timeframe my dashboard is using displays the count numbers.
I guess I needed to sleep on it and it was clear.

Thanks for answering !