# Count occurrences of a variable term

**URL:** <https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511>\
**Category:** Elasticsearch\
**Created:** [May 12, 2022, 12:00am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511 "2022-05-12T00:00:58Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![MobileOne](https://avatars.discourse-cdn.com/v4/letter/m/ac8455/32.png) [@MobileOne](https://discuss.elastic.co/u/MobileOne)\
**Post date:** [May 12, 2022, 12:00am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/1 "2022-05-12T00:00:58Z")

</div>

In my logs I have a field "message" that has in it among other strings one term "UserID:" followed by a value.

This value is mostly different in each document, but sometimes the same UserID is logged.

I am trying to find a way to count the number of times each UserID is logged.

I have been researching but can't find a way to isolate the value after "UserID:" and then count based on this value.

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [May 12, 2022, 1:05am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/2 "2022-05-12T01:05:46Z")

</div>

Hi @MobileOne .

Could you give an example of the indexed doc?

---

<div class="post-metadata">

**Author:** ![MobileOne](https://avatars.discourse-cdn.com/v4/letter/m/ac8455/32.png) [@MobileOne](https://discuss.elastic.co/u/MobileOne)\
**Post date:** [May 12, 2022, 1:57am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/3 "2022-05-12T01:57:19Z")

</div>

Hi @RabBit_BR

You will see below that the "message" field has "response={ UserId:" followed by the ID that I want to count across all the results.

```auto
{
        "_index" : ".sample-2022.05.10-001311",
        "_type" : "_doc",
        "_id" : "ECaIr4ABpdjiMbYDoZXE",
        "_score" : 49.102036,
        "_ignored" : [
          "message.keyword"
        ],
        "_source" : {
          "container" : {
            "image" : {
              "name" : "xyz.amazonaws.com/user:3.471ae2"
            }
          },
          "cluster" : "qa",
          "kubernetes" : {
            "container" : {
              "name" : "user"
            },
            "pod" : {
              "ip" : "70.71.245.322",
              "name" : "user-6768fdff5-v33k"
            },
            "namespace" : "qa",
            "replicaset" : {
              "name" : "user-6734573255"
            },
            "labels" : {
              "service" : "user",
              "pod-template-hash" : "2554339581",
              "track" : "stable"
            }
          },
          "level" : "INFO",
          "project" : "test",
          "message" : "[2022-05-10 19:53:27.228] [INFO] response={ UserId: '977dfe3fd034c8609b6ec63cafd0d14f57caa24536593c7f2f3df6f2a6b4c1236e1147fb44a1eb6', registrationId: '9D702A7B-B676-E74E0799', rawRequest: undefined, rawResponse: undefined, token: 'f80b7a786cc49a29d03ed9a1c06954dd521c70fef445aada4eb8511eb12170f677b7ba68bbe56f595a575f1', timestamp: '1652212407227' } responseTime=987 service=user traceId=7dd7a96b8ce051f1",
          "market" : "us",
          "input" : { },
          "environment" : "staging",
          "@timestamp" : "2022-05-10T19:53:27.228Z",
          "ecs" : { },
          "stream" : "stdout",
          "service" : "user",
          "host" : {
            "name" : "ip-70-71-245-322"
          },
          "region" : "us",
          "event" : "authorize"
        }
  }

```

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [May 12, 2022, 5:45am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/4 "2022-05-12T05:45:34Z")

</div>

I don't see a way to do this.  
Maybe another user can help you.  
Excuse me.

---

<div class="post-metadata">

**Author:** ![MobileOne](https://avatars.discourse-cdn.com/v4/letter/m/ac8455/32.png) [@MobileOne](https://discuss.elastic.co/u/MobileOne)\
**Post date:** [May 12, 2022, 3:06pm UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/5 "2022-05-12T15:06:43Z")

</div>

Thanks @RabBit_BR, I think that the direction is via the Analizer, but lack of experience with this feature is an issu

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 13, 2022, 6:19am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/6 "2022-05-13T06:19:25Z")

</div>

Hi,

If it raise no performance problem, one possible way is using runtime field for UserId. With runtime field, you can use script to almost freely process the message field to extract the UserId. As it processes the entire documents for each query however, it may cause fatal performance problems.

In my opinion, it should be addressed before indexing. Using logstash for example, you can parse the message field and create UserId field suitable for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 13, 2022, 6:24am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/7 "2022-05-13T06:24:55Z")

</div>

[Ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/common-log-format-example.html) is another solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2022, 6:25am UTC](https://discuss.elastic.co/t/count-occurrences-of-a-variable-term/304511/8 "2022-06-10T06:25:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.