# Can't get my head around the Query Language

**URL:** https://discuss.elastic.co/t/cant-get-my-head-around-the-query-language/36737
**Category:** Elasticsearch
**Created:** [December 9, 2015, 11:52am UTC](https://discuss.elastic.co/t/cant-get-my-head-around-the-query-language/36737 "2015-12-09T11:52:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![aidzan](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@aidzan](https://discuss.elastic.co/u/aidzan)
#### Post date: [December 9, 2015, 11:52am UTC](https://discuss.elastic.co/t/cant-get-my-head-around-the-query-language/36737/1 "2015-12-09T11:52:27Z")

</div>

I am using Elasticsearch to store alerts from our alerting system for metrics. I have a requirement where I need to pull Count of alerts grouped by Gateway and Application

I have been able to pull the Count for Application using agg, which gave me the following:

{  
"key" : "App\_num",  
"doc\_count" : 15135  
},

How can I also make this Key take into consideration my Gateway that these Applications are related to so that it gives me a total count of each Application per Gateway? I am using the following to get the above:

curl -XPOST 'localhost:9200/\_search?pretty' -d '  
{  
"aggs": {  
"group\_by\_app": {  
"terms": {  
"field": "AppNum",  
"size": 0  
}  
}  
}  
}'

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:32pm UTC](https://discuss.elastic.co/t/cant-get-my-head-around-the-query-language/36737/2 "2017-07-05T23:32:19Z")

</div>


