# Aggregating multiple values from single fields

**URL:** <https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176>\
**Category:** Kibana\
**Created:** [May 19, 2022, 11:10am UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176 "2022-05-19T11:10:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarioRojas](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\
**Post date:** [May 19, 2022, 11:10am UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/1 "2022-05-19T11:10:43Z")

</div>

Hi all,

I have some documents, where a given field can have one or several values (strings or numerical, not mixed though) and I wanted to know if it's possible to operate these, like count the number of values of one type

It looks something like this when I go to discovery:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/408bd863a050bd33397ec4035c1585124ee965e0.png)

Thanks in advance for any info and/or help!

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 19, 2022, 11:28am UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/2 "2022-05-19T11:28:14Z")

</div>

Hi,

I suppose it is difficult to do that in usual query.  
If performance is ok, [using runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html) is a good try.

Or you may use ingest pipeline to execute the calculation while ingesting.

---

<div class="post-metadata">

**Author:** ![MarioRojas](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\
**Post date:** [May 20, 2022, 8:42am UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/3 "2022-05-20T08:42:20Z")

</div>

Hi Tomo,

Thanks for the reply.  
I am stuck in the script, when I try to get the list.  
I've tried .size() or .length to check the number of elements, but I always get 1 instead of the correct value.

This is what i've in general done so far.

```auto
int n_instances = 0;
def pone = +1;
def dsource = doc["json.meta.occurrences_fp.source_target_type.keyword"];
for(cur_source in dsource){
    if(cur_source == 'FUSD'){
    n_instances = pone; 
    }
}
emit(n_instances)

```

I've seen that .\_source could also be used, but haven't managed either ...

Is this what you meant or what should I better go for?  
(I've read that painless is not good for accessing nested documents, is this correct, should I better, reformat my documents ?)

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 21, 2022, 6:04am UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/4 "2022-05-21T06:04:20Z")

</div>

As you tried, there are [.length accessor for array](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-operators-array.html#array-length-operator).

`.length` worked fine for me. What is the difference??

```auto
PUT test_runtime_field
{
  "mappings": {
    "properties": {
      "original":{
        "type": "text",
        "fields":{
          "keyword":{
            "type": "keyword"
          }
        }
      }
    }
  }
}

POST test_runtime_field/_doc
{
  "original": ["aaa", "bb", "c"]
}

POST test_runtime_field/_doc
{
  "original": "aaa"
}

PUT test_runtime_field/_mapping
{
  "runtime":{
    "original_length":{
      "type": "long",
      "script":{
        "source": "emit(doc['original.keyword'].length)"
      }
    }
  }
}

GET test_runtime_field/_search
{
  "fields":["original_length"]
}

```

If you are using text field and/or turn off `doc_values`, you have to use `_source` field and check if it is array or not.

```auto
DELETE test_runtime_field

PUT test_runtime_field
{
  "mappings": {
    "properties": {
      "original":{
        "type": "text"
      }
    }
  }
}

POST test_runtime_field/_doc
{
  "original": ["aaa", "bb", "c"]
}

POST test_runtime_field/_doc
{
  "original": "aaa"
}

PUT test_runtime_field/_mapping
{
  "runtime":{
    "original_length":{
      "type": "long",
      "script":{
        "source": """
          if (params._source['original'] instanceof ArrayList){
            emit(params._source['original'].length)
          } else {emit(1)} """
      }
    }
  }
}

GET test_runtime_field/_search
{
  "fields":["original_length"]
}

```

---

<div class="post-metadata">

**Author:** ![MarioRojas](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@MarioRojas](https://discuss.elastic.co/u/MarioRojas)\
**Post date:** [May 24, 2022, 12:43pm UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/5 "2022-05-24T12:43:10Z")

</div>

I don't know why it doesn't work,  
I tried with a dummy array of (apparently) the same characteristics and it worked, but with the real one, couldn't manage.  
Anyway, I had to change the format of the documents, since I also needed to tabulate some of those results and with this structure it was getting over complicated for the display...  
Thanks anyway for the support!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2022, 12:43pm UTC](https://discuss.elastic.co/t/aggregating-multiple-values-from-single-fields/305176/6 "2022-06-21T12:43:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.