# Use of "Terms" as "Buckets" with "Parent Pipeline Aggregations" e.g. "Derivative"

**URL:** <https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966>\
**Category:** Kibana\
**Created:** [October 5, 2020, 10:00am UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966 "2020-10-05T10:00:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![malsioufi](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@malsioufi](https://discuss.elastic.co/u/malsioufi)\
**Post date:** [October 5, 2020, 10:00am UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/1 "2020-10-05T10:00:39Z")

</div>

Hi,  
I am working on some visualization to track number of issues (let's say bugs) over different versions of a system, and I am aiming to build a visualization with Kibana that uses the release name as X-axis and the diff. of number of issues between releases on the Y-axis. Something like the following. (Blue is number of issues, and orange is the changes I am interested in)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/a/7ae143a06b20b8e109b79b242586c854ce83fb7f.png)

The versions are named after fruits and vegetables in an alphabetic order starting from A.

I have tried to use the visualization functionality in Kibana, but when I choose the Aggregation (Y-axis) to be "Derivative" of "Sum" of issues, I am not able to choose the Buckets (X-axis) as "Terms" to choose the version field which is stored as string, and I am getting the error message (Last bucket aggregation must be "Date Histogram" or "Histogram" when using "Derivative" metric aggregation.)

![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/eca5c3b83698f784f0ae7c7040759b21bb903c77.png)

Is there a way or a work-around to achieve this goal? Because from the version's perspective, they do represent some chronological order but not in a date format.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [October 5, 2020, 2:57pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/2 "2020-10-05T14:57:10Z")

</div>

Hello,

Yes, that is a limitation coming from Elasticsearch, the Derivative or Serial Diff aggregation only works on Histograms (be it normal or Date), mostly due to limitations linked to edge cases.  
The only solution I see would be to create a scripted field that assigns numeric values to each version name and then do the Derivative agg on that new scripted field. What would be great if annotations were available in order to see the actual version name, but that's not possible yet. It's an open issue for improvement in Lens: [https://github.com/elastic/kibana/issues/62277](https://github.com/elastic/kibana/issues/62277)  
And TSVB won't work for you since you don't have time series data.

---

<div class="post-metadata">

**Author:** ![malsioufi](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@malsioufi](https://discuss.elastic.co/u/malsioufi)\
**Post date:** [October 5, 2020, 9:17pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/3 "2020-10-05T21:17:28Z")

</div>

Thanks for you answer Marius, that's a shame ☹  
Waiting to see this functionality implemented at some time soon.

---

<div class="post-metadata">

**Author:** ![malsioufi](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@malsioufi](https://discuss.elastic.co/u/malsioufi)\
**Post date:** [October 6, 2020, 2:30pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/4 "2020-10-06T14:30:42Z")

</div>

Thank you @Marius_Dragomir for the scripted field tip! I solved the issue by creating a scripted field as you suggested so it has a numeric value for each version, so its script looks like this:

```auto
if(doc['release.keyword'].value == "Apple"){
    return 0
}
else{
    if(doc['release.keyword'].value == "Banana"){
        return 1
    } 
    else{
        if(doc['release.keyword'].value == "Banana2"){
            return 2
        }
        else{
			if(doc['release.keyword'].value == "Coconut"){
				return 3
			}
			else{
				return 4
			}
        }
    }
}

```

Then fixed its Format to be a lookup table

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d873c38a653d297beb6045b2e0d4b88264a1c9aa.png)

This is a very ugly work around but it works since I have a limited number of terms, so far.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [October 11, 2020, 9:03pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/5 "2020-10-11T21:03:05Z")

</div>

Indeed, it's not really scalable sadly. Glad it helped you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2020, 9:03pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966/6 "2020-11-08T21:03:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.