# Get all buckets with just one item

**URL:** <https://discuss.elastic.co/t/get-all-buckets-with-just-one-item/147098>\
**Category:** Elasticsearch\
**Created:** [September 3, 2018, 2:59pm UTC](https://discuss.elastic.co/t/get-all-buckets-with-just-one-item/147098 "2018-09-03T14:59:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JPelastic](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@JPelastic](https://discuss.elastic.co/u/JPelastic)\
**Post date:** [September 3, 2018, 2:59pm UTC](https://discuss.elastic.co/t/get-all-buckets-with-just-one-item/147098/1 "2018-09-03T14:59:09Z")

</div>

```auto
GET certificates/_search
{
  "size": 0, 
  "aggs": {
    "per month": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "month"
      }, 
      "aggs": {
        "distinct": {
          "terms": {
            "field": "companyname.keyword",
            "size": 10
          },
          "aggs": {
            "one": {
              "max": {
                "distinct.doc_count": "1"
}}}}}}}}

```

This does not work, since I cannot access the doc\_count of the previous aggregation. Could anyone point me to an alternative way of selecting all buckets that have exactly one item in them.

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [September 3, 2018, 10:54pm UTC](https://discuss.elastic.co/t/get-all-buckets-with-just-one-item/147098/2 "2018-09-03T22:54:25Z")

</div>

Sort by the terms agg by the rarest company names.  
If you have many unique companies this can be wildly inaccurate though so see this technique of using multiple requests to bring back accuracy: [https://github.com/elastic/elasticsearch/issues/17614#issuecomment-373689578](https://github.com/elastic/elasticsearch/issues/17614#issuecomment-373689578)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 10:54pm UTC](https://discuss.elastic.co/t/get-all-buckets-with-just-one-item/147098/3 "2018-10-01T22:54:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.