# Can you set partition field and count by as the same field?

**URL:** <https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [October 10, 2022, 3:54pm UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244 "2022-10-10T15:54:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![emi\_rose](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emi_rose/32/83050_2.png) [@emi\_rose](https://discuss.elastic.co/u/emi_rose)\
**Post date:** [October 10, 2022, 3:54pm UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244/1 "2022-10-10T15:54:25Z")

</div>

I have been trying to create a machine learning job that detects that a certain job that has been running for an anomalous amount of time. Sometimes this job runs for much longer than expected and sometimes much shorter. Since I don't have a duration field to work with, I'm just relying on high and low doc counts as those are usually indicative of how long the job is running for.

My question is about whether or not I can set my partition field and the count by field as the same field. I want the job to run independently across each value of this field, but this is also field that has the doc counts I want to analyze.

When I set my multi bucket ML job this way, it says that it cannot parse the data. However, I can't think of what other field to set for it to count on.

Thanks

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 20, 2022, 2:27am UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244/2 "2022-10-20T02:27:57Z")

</div>

hi!

there is no `count by` field in the [ML jobs](https://www.elastic.co/guide/en/elasticsearch/reference/8.4/ml-put-job.html).

I assume you mean `by_field_name ` which is a way to split the analysis (like a "for each"). It is similar to `partition_field_name` but has [subtle differences](https://discuss.elastic.co/t/ml-what-is-the-difference-between-by-field-name-and-partition-field-name/108720/2).

sounds like all you need is a `count` function and define a `partition_field_name` and that's all!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2022, 10:16pm UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244/3 "2022-11-16T22:16:38Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2022, 10:17pm UTC](https://discuss.elastic.co/t/can-you-set-partition-field-and-count-by-as-the-same-field/316244/4 "2022-12-14T22:17:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.