# Counting faults per region given there are no repeats

**URL:** <https://discuss.elastic.co/t/counting-faults-per-region-given-there-are-no-repeats/279747>\
**Category:** Kibana\
**Created:** [July 27, 2021, 3:17pm UTC](https://discuss.elastic.co/t/counting-faults-per-region-given-there-are-no-repeats/279747 "2021-07-27T15:17:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ammaars](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@ammaars](https://discuss.elastic.co/u/ammaars)\
**Post date:** [July 27, 2021, 3:17pm UTC](https://discuss.elastic.co/t/counting-faults-per-region-given-there-are-no-repeats/279747/1 "2021-07-27T15:17:08Z")

</div>

I'm planning on having live data streaming to kibana on elasticsearch. The fields of concern will be "failure" (0 or 1), region (e.g. region 1-12) and a unique endpoint identifier. What I'd like to do is have a query which counts failures per region without counting the same endpoint more than once. I could then adjust this to 5 minute intervals and then graph as multiple lines per region it if the query is feasible. I'd really appreciate any help with this as I'm very new to kibana and elastic search :). Thank you!

---

<div class="post-metadata">

**Author:** ![brianseeders](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brianseeders/32/84831_2.png) [@brianseeders](https://discuss.elastic.co/u/brianseeders)\
**Post date:** [August 2, 2021, 7:18pm UTC](https://discuss.elastic.co/t/counting-faults-per-region-given-there-are-no-repeats/279747/2 "2021-08-02T19:18:45Z")

</div>

Hey @ammaars,

I think you may be able to accomplish what you want with a pipeline aggregation.

See my screenshots using the sample data that ships with Kibana. I'm using `hour_of_day: 17`, but you could use something like `failure: 1` instead, and regions instead of `DestCountry`. I'm using `Max` to ensure that each country is only getting counted once per time window.

Is this helpful?

 ![Screen Shot 2021-08-02 at 3.11.58 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7eb33f5aa31d9092228e79caf4ec020486fa9cc0.png)  
 ![Screen Shot 2021-08-02 at 3.12.18 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d5fd04e6e4d9a80fec7fd34833aa708e9df686a.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2021, 7:18pm UTC](https://discuss.elastic.co/t/counting-faults-per-region-given-there-are-no-repeats/279747/3 "2021-08-30T19:18:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.