# Facet question histogram and group by

**URL:** <https://discuss.elastic.co/t/facet-question-histogram-and-group-by/4842>\
**Category:** Elasticsearch\
**Created:** [July 13, 2011, 4:59am UTC](https://discuss.elastic.co/t/facet-question-histogram-and-group-by/4842 "2011-07-13T04:59:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mobsniuk](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@mobsniuk](https://discuss.elastic.co/u/mobsniuk)\
**Post date:** [July 13, 2011, 4:59am UTC](https://discuss.elastic.co/t/facet-question-histogram-and-group-by/4842/1 "2011-07-13T04:59:40Z")

</div>

I am trying to do a graph of CPU load recorded from a log. I'd like  
hourly averages. I thought the following might work but all I get is a  
single entry. I'd also like to know how I could do something like  
group by. I have an IP address associated with each entry. I read that  
multiple facets are allowed but haven't seen any examples so far on  
how one might accomplish this.

{  
"query": {  
"filtered": {  
"query": {  
"match\_all": {}  
},  
"filter": {  
"term": {  
"@type": "devicecpustats"  
}  
}  
}  
},  
"facets": {  
"histo1": {  
"histogram": {  
"field": "cpuBusy",  
"time\_interval": "1h"  
}  
}  
}  
}

Thanks,

Mark

---

<div class="post-metadata">

**Author:** ![Jurgen\_kartnaller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jurgen_kartnaller/32/3086_2.png) [@Jurgen\_kartnaller](https://discuss.elastic.co/u/Jurgen_kartnaller)\
**Post date:** [July 13, 2011, 5:11am UTC](https://discuss.elastic.co/t/facet-question-histogram-and-group-by/4842/2 "2011-07-13T05:11:26Z")

</div>

I guess you should use a date histogram based on the log timestamp.

Something like this:

"facets": {  
"histo1": {  
"date\_histogram": {  
"key\_field": "ts",  
"value\_field": "cpuBusy",  
"interval": "1h"  
}  
}  
}

Also note that the facet operates on the query result not on the filtered  
result.

Jürgen

On Wed, Jul 13, 2011 at 6:59 AM, Mark Obsniuk [mobsniuk@gmail.com](mailto:mobsniuk@gmail.com) wrote:

> I am trying to do a graph of CPU load recorded from a log. I'd like  
> hourly averages. I thought the following might work but all I get is a  
> single entry. I'd also like to know how I could do something like  
> group by. I have an IP address associated with each entry. I read that  
> multiple facets are allowed but haven't seen any examples so far on  
> how one might accomplish this.
> 
> {  
> "query": {  
> "filtered": {  
> "query": {  
> "match\_all": {}  
> },  
> "filter": {  
> "term": {  
> "@type": "devicecpustats"  
> }  
> }  
> }  
> },  
> "facets": {  
> "histo1": {  
> "histogram": {  
> "field": "cpuBusy",  
> "time\_interval": "1h"  
> }  
> }  
> }  
> }
> 
> Thanks,
> 
> Mark

--  
[http://www.sfgdornbirn.at](http://www.sfgdornbirn.at)  
[http://www.mcb-bregenz.at](http://www.mcb-bregenz.at)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:00am UTC](https://discuss.elastic.co/t/facet-question-histogram-and-group-by/4842/3 "2017-07-06T04:00:55Z")

</div>

Closed on July 6, 2017, 4:00am UTC