# Count duplicated field value by doc

**URL:** https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567
**Category:** Kibana
**Created:** [August 2, 2019, 2:46pm UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567 "2019-08-02T14:46:29Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![chaymaa](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@chaymaa](https://discuss.elastic.co/u/chaymaa)
#### Post date: [August 2, 2019, 2:46pm UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567/1 "2019-08-02T14:46:29Z")

</div>

Hi All,  
I have already aggregate and filter my message into elastic search, and i have now a problem to display the results on a kibana bar chart,  
This is the final filtered message:  
{  
"features" =\> [  
[0] {  
"action" =\> "[Connexion]",  
"status" =\> "Passed"  
},  
[1] {  
"action" =\> "[Creation\_Circuit]",  
"status" =\> "Passed"  
},  
[2] {  
"action" =\> "[Connexion]",  
"status" =\> "Failed"  
}  
],  
"@version" =\> "1",  
"scenario" =\> "001\_SeL\_Scenario\_Realisation\_Circuit\_Nominal",  
"@timestamp" =\> 2019-08-02T11:25:38.730Z  
}  
{  
"features" =\> [  
[0] {  
"action" =\> "[Connexion]",  
"status" =\> "Failed"  
}  
],  
"@version" =\> "1",  
"scenario" =\> "002\_SeL\_Scenario\_Realisation\_Circuit\_Depuis\_Modele",  
"@timestamp" =\> 2019-08-02T11:25:44.769Z  
}

the task\_id is the field scenario, and i want to count the number of status (passed /failed) by scenario  
here what i do on kibana but the result is not correct, i have 1 status Passed for the first scenario (001\_SeL\_Scenario\_Realisation\_Circuit\_Nominal) , i must have 2 as result:

 ![kibana_graph](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e81c45de84cf79d752f52839dd21d72e82a1d1b4.png)

someone can help me please?  
thank you in advance.

---

<div class="post-metadata">

### Author: ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)
#### Post date: [August 2, 2019, 7:27pm UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567/2 "2019-08-02T19:27:28Z")

</div>

Hi @chaymaa,

The way your data is formatted is making it a bit hard to read. Is this how one of your individual documents looks when you retrieve it from ES?

```auto
{
  "features": [
    { "action": "[Connexion]", "status": "Passed" },
    { "action": "[Connexion]", "status": "Passed" }
  ],
  "@version": "1",
  "scenario": "001_SeL_Scenario_Realisation_Circuit_Nominal",
  "@timestamp": "2019-08-02T11:25:38.730Z"
}

```

If so, it's going to be difficult to visualize it in Kibana with the existing structure because we don't currently have support for [querying nested fields](https://github.com/elastic/kibana/issues/1084), though it's one of our most requested features.

My recommendation would be to structure your data so that each of the features is a separate document in Elasticsearch. This will make it much easier to make a visualization like you've described. For example, you could have a features index:

```auto
POST features/_doc
{
  "action": "[Connexion]",
  "status": "Passed",
  "@version": "1",
  "scenario": "001_SeL_Scenario_Realisation_Circuit_Nominal",
  "@timestamp": "2019-08-02T11:25:38.730Z"
}

```

If each feature were split into a separate document, it would be easy to do a terms aggregation on the `scenario`, and then get accurate counts for `status`

---

<div class="post-metadata">

### Author: ![chaymaa](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@chaymaa](https://discuss.elastic.co/u/chaymaa)
#### Post date: [August 5, 2019, 8:36am UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567/3 "2019-08-05T08:36:53Z")

</div>

Hi @lukeelmers,

Thanks for your feedback,

I passed two days looking for the solution of querying nested fields 🙂

Actually this feature seems important to me too and it will be nice if ELK teams plan to implement it in the future versions.

Best regards.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2019, 8:37am UTC](https://discuss.elastic.co/t/count-duplicated-field-value-by-doc/193567/4 "2019-09-02T08:37:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.