# Count the percentage of character fields

**URL:** <https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168>\
**Category:** Elasticsearch\
**Created:** [December 26, 2017, 4:25am UTC](https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168 "2017-12-26T04:25:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 26, 2017, 4:25am UTC](https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168/1 "2017-12-26T04:25:22Z")

</div>

Hi, everyone:  
I want to count the percentage of specified field data.  
this is my Rest API:

```
GET _search
{
"_source": {
  "includes": ["FIRST_SWITCHED", "LAST_SWITCHED","IPV4_DST_ADDR","L4_DST_PORT","IPV4_SRC_ADDR","L7_PROTO_NAME","IN_BYTES","IN_PKTS","OUT_BYTES","OUT_PKTS"]
},
"from" : 0, "size" : 10000,
"query": {
"bool": {
  "must": [
    {
        "match" : { "_index" : "logstash-2017.12.22" }
    },
    {
        "match_phrase":{"IPV4_SRC_ADDR":"192.168.0.159"}
    },
    
    {
      "range" : {
        "LAST_SWITCHED" : {
            "gte" : 1513683600
        }
        }
    }
    
  ]
}
},
"aggs": {
  "IN_PKTS": {
    "sum": {
      "field": "IN_PKTS"
    }
  },
  "IN_BYTES": {
    "sum": {
      "field": "IN_BYTES"
    }
  },
  "OUT_BYTES": {
    "sum": {
      "field": "OUT_BYTES"
    }
  },
  "OUT_PKTS": {
    "sum": {
      "field": "OUT_PKTS"
    }
  },
  "percent":{
    "significant_terms" : {
            "field" : "L7_PROTO_NAME",
            "percentage":{}
        }},
    "protocol" : {
         "terms" : {
             "field" : "PROTOCOL",
             "include" : ["17", "6"]      
            }
  },
    "Using_port_count" : {                 
        "cardinality" : {
            "field" : "L4_SRC_PORT"
        }
    }
}
}

```

but there's some errors.

thank you in advance!

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 26, 2017, 7:32am UTC](https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168/3 "2017-12-26T07:32:23Z")

</div>

this is error message:

"reason": "Fielddata is disabled on text fields by default. Set fielddata=true on [L7\_PROTO\_NAME] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 26, 2017, 9:47am UTC](https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168/4 "2017-12-26T09:47:26Z")

</div>

ok, I find the answer!

just add .keyword at here then it can run!

"field" : "L7\_PROTO\_NAME.keyword"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2018, 9:47am UTC](https://discuss.elastic.co/t/count-the-percentage-of-character-fields/113168/5 "2018-01-23T09:47:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.