# Visualizing Sum of Two Fields

**URL:** https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427
**Category:** Kibana
**Created:** [June 14, 2017, 5:10pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427 "2017-06-14T17:10:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![xwang1](https://avatars.discourse-cdn.com/v4/letter/x/ed8c4c/32.png) [@xwang1](https://discuss.elastic.co/u/xwang1)
#### Post date: [June 14, 2017, 5:10pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427/1 "2017-06-14T17:10:17Z")

</div>

I'm new to Kibana/Elasticsearch and I'm trying to visualize traffic data between servers. However my logstash indices only contain the fields "fwdbytes" (bytes sent out) and "bwdbytes" (bytes received). I am trying to visualize the amount of traffic per IP address.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8b67dc793d01f2e366d027075fae45f54350ba56.png)  
This is my visualization for fwdbytes.  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2505669a23552ebed48bb6bf1759f702aac7c3a.png)  
Here is my visualization for bwdbytes.

Now I want to combine the 2 separate visualizations into a single visualization by displaying the sum of fwdbytes+bwdbytes of each IP.

I've tried modifying the visualization in the Saved Objects panel of the Management tab, but I can't get Kibana to recognize the scripting inside visState. I've also tried directly modifying my logstash indices using DevTools:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39f9536376f252ce4ad256ad2dd9dd46e140e17b.png)

The first API scripts a new field "totbytes" which is the sum of "fwdbytes" and "bwdbytes". However I don't think "totbytes" is stored in the logstash indices as even after I run the script and then try to create a visualization, Kibana does not recognize the "totbytes" field. The second API tries to create a new field inside "\_source" for each document using update by query, however I don't think I scripted it properly as it does not compile. Any help is much appreciated.

---

<div class="post-metadata">

### Author: ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [June 14, 2017, 5:14pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427/2 "2017-06-14T17:14:50Z")

</div>

I suggest using a [scripted field](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html) that represents the sum of traffic per event

---

<div class="post-metadata">

### Author: ![xwang1](https://avatars.discourse-cdn.com/v4/letter/x/ed8c4c/32.png) [@xwang1](https://discuss.elastic.co/u/xwang1)
#### Post date: [June 14, 2017, 5:56pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427/3 "2017-06-14T17:56:40Z")

</div>

Thanks for the help - I got it now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 12, 2017, 5:56pm UTC](https://discuss.elastic.co/t/visualizing-sum-of-two-fields/89427/4 "2017-07-12T17:56:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.