Subject might be a bit confusing so here is an example. Let's say that I have logs that looks like this: { "filed1":"name","count":number}. For a specific time period I have 5 logs with field1 value "A". One of them has count 1 and the others count 0 and 7 logs with field1 value "B", all of them with count 0. I need to create a table that will show the values of field1 that had only count 0 for the specific time period. What I used is a sum aggregation on count and listing the filed1 values in ascending order. The first entry will be "B" with value 0 (7 * 0) and the second entry will be A with value 1 (4 * 0 + 1). The solution works, I wonder if there is a way to get a table that lists only the entries with value 0. In this case it will have one entry, "B".
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.