# Aggregation with conditions **URL:** \ **Category:** Elasticsearch\ **Created:** [April 1, 2014, 10:17am UTC](https://discuss.elastic.co/t/aggregation-with-conditions/16735 "2014-04-01T10:17:30Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![lvalbuena](https://avatars.discourse-cdn.com/v4/letter/l/c6cbf5/32.png) [@lvalbuena](https://discuss.elastic.co/u/lvalbuena)\ **Post date:** [April 1, 2014, 10:17am UTC](https://discuss.elastic.co/t/aggregation-with-conditions/16735/1 "2014-04-01T10:17:30Z")
Hi, I have 2 cases. Given the structure { email:value, points:value } Case 1: I have 1000 rows, where multiple rows can have the same value for the email field. {"email":"some@email.com","points":5} {"email":"some@email.com","points":2} ... How do I tell elasticsearch to search for all emails that have only appeared _once_ in the data set. Case 2: Also using aggregation. How can I tell elasticsearch to get all possible occurrences the emails appeared in the data set. ex. emails = 5, occourances \>= 5 // There are 5 emails that appeared 4 times in the dataset emails = 6, occourances = 4 emails = 23, occourances = 3 emails = 2, occourances = 2 emails = 12, occourances = 1 Or is it even posible? Thanks -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/240d054f-131c-4904-81d6-95b7982f2f6c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/240d054f-131c-4904-81d6-95b7982f2f6c%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Binh\_Ly\_2](https://avatars.discourse-cdn.com/v4/letter/b/d07c76/32.png) [@Binh\_Ly\_2](https://discuss.elastic.co/u/Binh_Ly_2)\ **Post date:** [April 1, 2014, 12:48pm UTC](https://discuss.elastic.co/t/aggregation-with-conditions/16735/2 "2014-04-01T12:48:58Z")
The first one is not available, however a terms aggregation and sort by \_count asc will bubble up the least frequent terms (emails) and you can filter yourself which ones you want. The second one sounds like a simple terms aggregation on the email field (just make sure the email field is not\_analyzed): { "aggs": { "group\_by\_email": { "terms": { "field": "email" } } } } -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/3c2f9f63-9a05-4bd5-beda-093f162b48e2%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/3c2f9f63-9a05-4bd5-beda-093f162b48e2%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![lvalbuena](https://avatars.discourse-cdn.com/v4/letter/l/c6cbf5/32.png) [@lvalbuena](https://discuss.elastic.co/u/lvalbuena)\ **Post date:** [April 2, 2014, 1:02am UTC](https://discuss.elastic.co/t/aggregation-with-conditions/16735/3 "2014-04-02T01:02:20Z")
On Tuesday, April 1, 2014 6:17:30 PM UTC+8, lval...@egg.ph wrote: > Hi, > > I have 2 cases. > > Given the structure > { > email:value, > points:value > } > > Case 1: > I have 1000 rows, where multiple rows can have the same value for the > email field. > {"[email":"some@email.com](mailto:email%22:%22some@email.com)","points":5} > {"[email":"some@email.com](mailto:email%22:%22some@email.com)","points":2} > ... > > How do I tell elasticsearch to search for all emails that have only > appeared _once_ in the data set. > > Case 2: > Also using aggregation. How can I tell elasticsearch to get all possible > occurrences the emails appeared in the data set. > ex. > emails = 5, occourances \>= 5 // There are 5 emails that appeared 5 times > or greater in the dataset > emails = 6, occourances = 4 > emails = 23, occourances = 3 > emails = 2, occourances = 2 > emails = 12, occourances = 1 > > Or is it even posible? > > Thanks -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/70ad3a1d-283f-4828-b241-b151432d4957%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/70ad3a1d-283f-4828-b241-b151432d4957%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:38am UTC](https://discuss.elastic.co/t/aggregation-with-conditions/16735/4 "2017-07-06T01:38:52Z")
Closed on July 6, 2017, 1:38am UTC