# First occurrence field value using ingest processor

**URL:** <https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755>\
**Category:** Elasticsearch\
**Created:** [October 12, 2020, 11:12am UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755 "2020-10-12T11:12:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Post date:** [October 12, 2020, 11:12am UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755/1 "2020-10-12T11:12:55Z")

</div>

Hello

is there a way to tag a document with "first occurrence of a field" using an ingest processor?

for example first occurrence of traffic from Japan (country:Japan)

thanks

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [October 13, 2020, 1:21pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755/2 "2020-10-13T13:21:01Z")

</div>

Would it be easier to derive on the fly? This is an example query to find the first uses of popular tags on stackoverflow:

```
GET stackoverflow/_search
{
  "size":0,
  "aggs":{
	"tags":{
	  "terms":{
		"field": "tag",
		"collect_mode":"breadth_first"
	  },
	  "aggs":{
		"first_use":{
		  "top_hits": {
			"size": 1,
			"sort":[{ "creationDate" : {"order" : "asc"}}]
		  }
		}
	  }
	}
  }
}
```

---

<div class="post-metadata">

**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Post date:** [October 14, 2020, 3:37pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755/3 "2020-10-14T15:37:54Z")

</div>

> [@Mark\_Harwood](#):
>
> ```auto
> GET stackoverflow/_search
> {
> "size":0,
> "aggs":{
> "tags":{
> "terms":{
> "field": "tag",
> "collect_mode":"breadth_first"
> },
> "aggs":{
> "first_use":{
> "top_hits": {
> "size": 1,
> "sort":[{ "creationDate" : {"order" : "asc"}}]
> }
> }
> }
> }
> }
> }
> 
> ```

nice thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2020, 3:38pm UTC](https://discuss.elastic.co/t/first-occurrence-field-value-using-ingest-processor/251755/4 "2020-11-11T15:38:05Z")

</div>

Closed on November 11, 2020, 3:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.