# Grafana to use substraction of two fields in Elasticsearch data source

**URL:** <https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940>\
**Category:** Elasticsearch\
**Created:** [March 6, 2020, 6:00am UTC](https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940 "2020-03-06T06:00:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dilshanfdo](https://avatars.discourse-cdn.com/v4/letter/d/838e76/32.png) [@dilshanfdo](https://community.grafana.com/u/dilshanfdo)\
**Post date:** [March 6, 2020, 6:00am UTC](https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940/1 "2020-03-06T06:00:38Z")

</div>

Hi,

I have saw articles on ‘How to Add 2 fields in Grafana’ But i would like to know how to subtract 2 values in Grafana. Following is my scenario:

- I have two fields, called ‘status\_codes’ and requests
- I want to get number of failed requests.
- My equation is [requests - no of success requests]
- In the script i wrote something like this \_value - doc[’@status\_codes.200’].value

BUT the value return in the graph is ‘N/A’

I’m using elasticsearch(7.6.0) and Grafana(6.6.2).

Following is the out file which i’m sending to elasticsearch

```auto
    { "latencies":{
      "total":3981710268690,
      "mean":43876078,
      "50th":916913,
      "90th":2217744,
      "95th":5162430,
      "99th":60233348,
      "max":60000209373,
      "min":43652

},
   "@version":"1",
   "latest":"2020-03-05T16:14:44.23387091Z",
   "path":"test23.json",
   "duration":61163899322,
   "wait":552109,
   "status_codes":{
      "0":90624,
      "200":125

},
   "earliest":"2020-03-05T16:13:43.069971588Z",
   "rate":1483.702004057131,
   "throughput":2.0436707446156577,
   "@timestamp":"2020-03-05T16:14:44.453Z",
   "errors":[
      "Post http://www: dial tcp 0.0.0.0:0->10.133.9.87:8688: socket: too many open files",
      "Post http://www: dial tcp: lookup internal-netty-load-balancer-937469711.us-east-1.elb.amazonaws.com on 10.20.30.30: dial udp 10.20.30:45: socket: too many open files"

],
   "bytes_in":{
      "mean":70.90298515686123,
      "total":6434375

},
   "requests":90749,
   "Report_Title":"test23",
   "host":"ABS",
   "success":0.0013774256465635985,
   "end":"2020-03-05T16:14:44.234423019Z",
   "bytes_out":{
      "mean":70.90298515686123,
      "total":6434375

}
}

```

---

<div class="post-metadata">

**Author:** ![dpotapov](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dpotapov](https://community.grafana.com/u/dpotapov)\
**Post date:** [March 11, 2020, 4:57am UTC](https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940/2 "2020-03-11T04:57:45Z")

</div>

I’d go with something like this:

 ![image](https://us1.discourse-cdn.com/grafana/original/2X/1/10f5c26338a43378e7f449101c52851030992d97.png)

---

<div class="post-metadata">

**Author:** ![dilshanfdo](https://avatars.discourse-cdn.com/v4/letter/d/838e76/32.png) [@dilshanfdo](https://community.grafana.com/u/dilshanfdo)\
**Post date:** [March 11, 2020, 6:03am UTC](https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940/3 "2020-03-11T06:03:12Z")

</div>

Thank you @dpotapov. You saved my time.

---

<div class="post-metadata">

**Author:** ![yasirsinada](https://avatars.discourse-cdn.com/v4/letter/y/6de8d8/32.png) [@yasirsinada](https://community.grafana.com/u/yasirsinada)\
**Post date:** [November 19, 2020, 7:53pm UTC](https://community.grafana.com/t/grafana-to-use-substraction-of-two-fields-in-elasticsearch-data-source/26940/4 "2020-11-19T19:53:56Z")

</div>

How about serial difference? I have a time series that tracks bytes written (wr) and bytes read (rd) by the containers in my K8s node. These fileds are total count fields. I want to get the serial difference() over a period of time for the wr and rd, like wr[n+1]-wr[n]. How can I do that with the script filed? ES 6.8.10 grafana 6.1.1

 ![grafana-elastic-query](https://us1.discourse-cdn.com/grafana/original/2X/2/2ee9f3d7bc03c2bf4dcf0bf6a71dacdaf7d7b0a4.jpeg)