# Filter facet by term count
**URL:** https://discuss.elastic.co/t/filter-facet-by-term-count/15794
**Category:** Elasticsearch
**Created:** [February 14, 2014, 6:11am UTC](https://discuss.elastic.co/t/filter-facet-by-term-count/15794 "2014-02-14T06:11:43Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Anton\_T](https://discuss.elastic.co/u/Anton_T)
#### Post date: [February 14, 2014, 6:11am UTC](https://discuss.elastic.co/t/filter-facet-by-term-count/15794/1 "2014-02-14T06:11:43Z")
Hello, I have an apache log in ES and I want to get top daily IPs having
hit count \> 100, for example. Tried to use scripting but i have no idea how
to get to 'count' value of a term. Any advice?
Thank you.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@jpountz](https://discuss.elastic.co/u/jpountz)
#### Post date: [February 14, 2014, 9:08am UTC](https://discuss.elastic.co/t/filter-facet-by-term-count/15794/2 "2014-02-14T09:08:30Z")
This is typically something that you can do using a terms aggregation[1].
It would look something like:
{
"aggs" : {
"top\_ips" : {
"terms" : {
"field" : "ip\_address", // \<- change field name accordingly
"min\_doc\_count": 100
}
}
}
}
[1]
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
On Fri, Feb 14, 2014 at 7:11 AM, Anton T [at1650702@gmail.com](mailto:at1650702@gmail.com) wrote:
> Hello, I have an apache log in ES and I want to get top daily IPs having
> hit count \> 100, for example. Tried to use scripting but i have no idea how
> to get to 'count' value of a term. Any advice?
> Thank you.
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com)
> .
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
Adrien Grand
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j79draJz5HTV6%2B3iWWj56KdwoDiEX%3Ds9faXT%2Bqe1HLXYg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j79draJz5HTV6%2B3iWWj56KdwoDiEX%3Ds9faXT%2Bqe1HLXYg%40mail.gmail.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Anton\_T](https://discuss.elastic.co/u/Anton_T)
#### Post date: [February 14, 2014, 10:07am UTC](https://discuss.elastic.co/t/filter-facet-by-term-count/15794/3 "2014-02-14T10:07:20Z")
Wow. Have to upgrade ES from 0.9 to 1.x.
Thank you.
On Friday, February 14, 2014 1:08:30 PM UTC+4, Adrien Grand wrote:
> This is typically something that you can do using a terms aggregation[1].
> It would look something like:
>
> {
> "aggs" : {
> "top\_ips" : {
> "terms" : {
> "field" : "ip\_address", // \<- change field name accordingly
> "min\_doc\_count": 100
> }
> }
> }
> }
>
> [1]
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html)
>
> On Fri, Feb 14, 2014 at 7:11 AM, Anton T \<[at16...@gmail.com](mailto:at16...@gmail.com) \\>wrote:
>
> > Hello, I have an apache log in ES and I want to get top daily IPs having
> > hit count \> 100, for example. Tried to use scripting but i have no idea how
> > to get to 'count' value of a term. Any advice?
> > Thank you.
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e80ef007-1897-4a03-b5d9-79ce123af8d6%40googlegroups.com)
> > .
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
>
> --
> Adrien Grand
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e55b75fe-8fc2-4478-ba7d-007cf471691d%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e55b75fe-8fc2-4478-ba7d-007cf471691d%40googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:50am UTC](https://discuss.elastic.co/t/filter-facet-by-term-count/15794/4 "2017-07-06T01:50:13Z")