# Aggregation of count of terms (possibly...)

**URL:** <https://discuss.elastic.co/t/aggregation-of-count-of-terms-possibly/21907>\
**Category:** Elasticsearch\
**Created:** [January 29, 2015, 5:11pm UTC](https://discuss.elastic.co/t/aggregation-of-count-of-terms-possibly/21907 "2015-01-29T17:11:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticSearch\_Users\_](https://avatars.discourse-cdn.com/v4/letter/e/b4bc9f/32.png) [@ElasticSearch\_Users\_](https://discuss.elastic.co/u/ElasticSearch_Users_)\
**Post date:** [January 29, 2015, 5:11pm UTC](https://discuss.elastic.co/t/aggregation-of-count-of-terms-possibly/21907/1 "2015-01-29T17:11:36Z")

</div>

Hi all,

This is my first post as I'm relatively new to ElasticSearch, Logstash,  
Kibana etc. and I'm really enjoying the challenge of learning it all and  
applying it!

I'm reasonably familiar with basic aggregations now, but I'm trying to  
produce a particular report from an index and I would really appreciate  
some help or advice on how to approach it.

We index log entries from application servers and I'm capturing events like  
"login" and the "user id" that caused that event to fire. I can produce a  
report of total "login" events, a total count of unique "user ids" who  
logged in (based on a cardinality aggregation), a count of the top "user  
ids" who logged in the most (user "mike" logged in 23 times today etc.  
based on a terms aggregation), but I'd like to produce a report with the  
following data:

x users logged in 20 times today (assuming that 20 was the maximum  
frequency of any particular user id appearing in the logs)  
.  
y users logged in 18 times today  
.  
.  
z users logged in only 1 time today.

So a breakdown of the count of the frequency of "user id" entries (filtered  
by the "login" event). I don't need the user ids in this report, just the  
frequency breakdown if you see what I mean. I'm not sure if this would  
require a script (not used them before...) or some sub-aggregation, or  
something else?

Any ideas or assistance would be appreciated!

Many thanks,

Clive

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/a22c9066-6a99-4475-be49-42f4a3710b18%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a22c9066-6a99-4475-be49-42f4a3710b18%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:35am UTC](https://discuss.elastic.co/t/aggregation-of-count-of-terms-possibly/21907/2 "2017-07-06T00:35:52Z")

</div>