# Count field matches

**URL:** <https://discuss.elastic.co/t/count-field-matches/60547>\
**Category:** Logstash\
**Created:** [September 14, 2016, 9:08pm UTC](https://discuss.elastic.co/t/count-field-matches/60547 "2016-09-14T21:08:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [September 14, 2016, 9:08pm UTC](https://discuss.elastic.co/t/count-field-matches/60547/1 "2016-09-14T21:08:20Z")

</div>

Is there a way to count field occurences on an entry?  
I have this data:

```
      "cpus" => {
    "cpu0" => {
            "user" => 448515294,
          "user_p" => 0.3256,
            "nice" => 4644,
          "system" => 343251086,
        "system_p" => 0.2859,
            "idle" => 3324754264,
          "iowait" => 1326397,
             "irq" => 975,
         "softirq" => 657110,
           "steal" => 21766840
    },
    "cpu1" => {
            "user" => 492064907,
          "user_p" => 0.3266,
            "nice" => 3095,
          "system" => 380342848,
        "system_p" => 0.286,
            "idle" => 3196040078,
          "iowait" => 778998,
             "irq" => 212361,
         "softirq" => 20395641,
           "steal" => 22651504
    },
    "cpu2" => {
            "user" => 405626520,
          "user_p" => 0.2368,
            "nice" => 1997,
          "system" => 261763596,
        "system_p" => 0.1536,
            "idle" => 3039135978,
          "iowait" => 394322,
             "irq" => 302322,
         "softirq" => 417117840,
           "steal" => 19745895
    },
    "cpu3" => {
            "user" => 425121352,
          "user_p" => 0.3519,
            "nice" => 3012,
          "system" => 320322316,
        "system_p" => 0.2841,
            "idle" => 3405591011,
          "iowait" => 699824,
             "irq" => 49,
         "softirq" => 68332,
           "steal" => 18688737
    },
    "cpu4" => {
            "user" => 387204956,
          "user_p" => 0.3391,
            "nice" => 2533,
          "system" => 303255772,
        "system_p" => 0.29,
            "idle" => 3468212764,
          "iowait" => 296950,
             "irq" => 232,
         "softirq" => 80455,
           "steal" => 17710338
    },
    "cpu5" => {
            "user" => 362084413,
          "user_p" => 0.3364,
            "nice" => 1776,
          "system" => 276928325,
        "system_p" => 0.2776,
            "idle" => 3506362315,
          "iowait" => 293728,
             "irq" => 54481,
         "softirq" => 11395774,
           "steal" => 16864801
    },
    "cpu6" => {
            "user" => 341761869,
          "user_p" => 0.3347,
            "nice" => 2119,
          "system" => 280176674,
        "system_p" => 0.2911,
            "idle" => 3552852535,
          "iowait" => 278686,
             "irq" => 30,
         "softirq" => 51706,
           "steal" => 15925629
    },
    "cpu7" => {
            "user" => 517516225,
          "user_p" => 0.3324,
            "nice" => 1871,
          "system" => 363758653,
        "system_p" => 0.2828,
            "idle" => 2607610042,
          "iowait" => 259868,
             "irq" => 863261,
         "softirq" => 473192672,
           "steal" => 22282389
    }

```

I'd like to count the number of cpus.cpu\* occurences to know how many cores does the server have but I can't find how to do it.  
I've tried using this:

```
metrics {
            meter => ["[cpus][cpu*]" ]
        }

```

but it counts on a timeset instead of per-entry

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 15, 2016, 5:43am UTC](https://discuss.elastic.co/t/count-field-matches/60547/2 "2016-09-15T05:43:47Z")

</div>

I think you need to use a ruby filter that does `event['cpu_count'] = event['cpus'].keys.length` or similar.

---

<div class="post-metadata">

**Author:** ![Mormaii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mormaii/32/10790_2.png) [@Mormaii](https://discuss.elastic.co/u/Mormaii)\
**Post date:** [September 15, 2016, 9:01am UTC](https://discuss.elastic.co/t/count-field-matches/60547/3 "2016-09-15T09:01:59Z")

</div>

Worked perfectly! Never occured to me to use a ruby filter. Thank you

Would there be a way on Kibana/Grafana to graph nested field with wildcards? Such as MAX of cpus.cpu\*

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 15, 2016, 6:21pm UTC](https://discuss.elastic.co/t/count-field-matches/60547/4 "2016-09-15T18:21:23Z")

</div>

> Would there be a way on Kibana/Grafana to graph nested field with wildcards? Such as MAX of cpus.cpu\*

I don't think so but I'm no Kibana expert.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/count-field-matches/60547/5 "2017-07-06T04:38:13Z")

</div>

Closed on July 6, 2017, 4:38am UTC