Count fields with the same value as one

[Angelos]

Hi!

I have many fields which have the same value.

So let's we have those document in different time periods:

@timestamp	Jan 6, 2021 @ 23:00:00
field.mess 	value1
field.sub	examp1

@timestamp	Jan 6, 2021 @ 23:00:01
field.mess 	value1
field.sub	examp1

@timestamp	Jan 6, 2021 @ 23:00:02
field.mess 	value2
field.sub	examp1

Is there any way to count the value1 as one in Kibana?
So that the result in a graph should show that we have two field.mess(value1 and value2) not three.

Thank you in advance!

/Angelos

[wylie (Wylie Conlon)]

Yes, you can get an approximate count using the Cardinality/Unique Count aggregation. It is exact for small values, approximate for larger values: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html