# Finding first appearence of each value in a field?

**URL:** <https://discuss.elastic.co/t/finding-first-appearence-of-each-value-in-a-field/22602>\
**Category:** Elasticsearch\
**Created:** [March 10, 2015, 6:21pm UTC](https://discuss.elastic.co/t/finding-first-appearence-of-each-value-in-a-field/22602 "2015-03-10T18:21:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_Trei](https://avatars.discourse-cdn.com/v4/letter/p/9f8e36/32.png) [@Peter\_Trei](https://discuss.elastic.co/u/Peter_Trei)\
**Post date:** [March 10, 2015, 6:21pm UTC](https://discuss.elastic.co/t/finding-first-appearence-of-each-value-in-a-field/22602/1 "2015-03-10T18:21:55Z")

</div>

I'm very new to ELK, but learning. Maybe someone else has done this?

I have a set of records in per-day indices which include a timestamp, and a  
hostname (along with many  
other fields). Any given hostname (eg: [www.facebook.com](http://www.facebook.com)) may appear many  
times,

My goal is to create a report of the earliest appearance of each hostname,  
and further pull out  
a list each day of sites 'not seen before this day'.

I can get a JSON output for the host names (embedded in some JSON cruft}  
with

{  
"aggs": {  
"hosts": {  
"terms": {  
"field": "hostname",  
"size": 0  
}  
}  
}  
}

Problem 1: hostnames with embedded dashes fail - one of the strings  
delimited by dashes appears instead,  
so '[very-long-host-name.site.com](http://very-long-host-name.site.com)' might get listed as just 'long'.

Problem 2:  
I'm at a bit of a loss as to how to proceed from there.

Ideally, I'd like to be able to report the first appearance of any host, as  
well as any new in the last day or other  
time period

Thanks in advance...

pt

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0db536b2-9df7-4366-8f46-d42ff95cf742%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0db536b2-9df7-4366-8f46-d42ff95cf742%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:27am UTC](https://discuss.elastic.co/t/finding-first-appearence-of-each-value-in-a-field/22602/2 "2017-07-06T00:27:34Z")

</div>