# Aggrigation with a whole string as key **URL:** \ **Category:** Elasticsearch\ **Created:** [November 18, 2014, 1:46pm UTC](https://discuss.elastic.co/t/aggrigation-with-a-whole-string-as-key/20813 "2014-11-18T13:46:01Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Jorgen\_Lundberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jorgen_lundberg/32/1094_2.png) [@Jorgen\_Lundberg](https://discuss.elastic.co/u/Jorgen_Lundberg)\ **Post date:** [November 18, 2014, 1:46pm UTC](https://discuss.elastic.co/t/aggrigation-with-a-whole-string-as-key/20813/1 "2014-11-18T13:46:01Z")
Hi all, I asked this question at Stack Overflow last week. > In Kibana I'm trying to aggregate the top errors in our log by aggregating over a term we call LogMessage. This works well except that the aggregation counts the number each word in the LogMessage appears. Is it possible to aggregate over a whole string, or am I thinking about this the wrong way? /Jörgen -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![roger](https://avatars.discourse-cdn.com/v4/letter/r/c0e974/32.png) [@roger](https://discuss.elastic.co/u/roger)\ **Post date:** [November 18, 2014, 2:24pm UTC](https://discuss.elastic.co/t/aggrigation-with-a-whole-string-as-key/20813/2 "2014-11-18T14:24:09Z")
You have to index it as a single token. You can have the same string indexed twice using multi fields: > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Then you can index the string "not analyzed" (as in the multi fields page's example) or using keyword tokenizer if you need the field analyzed: > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. 2014-11-18 11:46 GMT-02:00 Jörgen Lundberg [jorgen.lundberg@gmail.com](mailto:jorgen.lundberg@gmail.com): > Hi all, > I asked this question at Stack Overflow last week. > > [elasticsearch - Is it possible to aggregate over a whole string in a Logstash query? - Stack Overflow](http://stackoverflow.com/questions/26909312/is-it-possible-to-aggregate-over-a-whole-string-in-a-logstash-query) > > In Kibana I'm trying to aggregate the top errors in our log by aggregating > over a term we call LogMessage. This works well except that the aggregation > counts the number each word in the LogMessage appears. > > Is it possible to aggregate over a whole string, or am I thinking about > this the wrong way? > > /Jörgen > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/4b9d4ebf-1cf1-4204-8b70-739539552d23%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAJp2533Gb5jQQLGmVAPykS4mYx9X7ewMVOD31awDYSU5NHBQKw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAJp2533Gb5jQQLGmVAPykS4mYx9X7ewMVOD31awDYSU5NHBQKw%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:49am UTC](https://discuss.elastic.co/t/aggrigation-with-a-whole-string-as-key/20813/3 "2017-07-06T00:49:13Z")