# Getting unique results on highlight or multiple fields

**URL:** https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650
**Category:** Elasticsearch
**Created:** [December 14, 2020, 10:56pm UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650 "2020-12-14T22:56:29Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sec\_r\_and\_d](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sec\_r\_and\_d](https://discuss.elastic.co/u/sec_r_and_d)
#### Post date: [December 14, 2020, 10:56pm UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650/1 "2020-12-14T22:56:29Z")

</div>

My indices contain various analyses of executable files.

```auto
DELETE static_index,strings_index

PUT static_index/_doc/1
{ "md5": "85e9e2c4a9c0a7af309c906516aa4548",
  "static_api": "ShellExecuteW" }

PUT static_index/_doc/2
{ "md5": "85e9e2c4a9c0a7af309c906516aa4548",
  "static_api": "ShellExecuteW" }

PUT strings_index/_doc/3
{ "md5": "85e9e2c4a9c0a7af309c906516aa4548",
  "strings_api": "ShellExecuteA" }

```

How can I modify this query...

```auto
GET *_index/_search
{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "*Execute*",
          "analyze_wildcard": true
        }}}},
  "highlight": {
    "fields": {
      "*.keyword": {}
    }}}

```

to get:

1. the first match per unique highlight?
2. the first match per unique (md5 AND index)?

Desired reply:

```auto
"hits" : [
  { "_index" : "static_index",
	"_source" : {
	  "md5" : "85e9e2c4a9c0a7af309c906516aa4548",
	  "static_api" : "ShellExecuteW" },
	"highlight" : {
	  "static_api.keyword" : [
		"<em>ShellExecuteW</em>"
	  ]}},
  { "_index" : "strings_index",
	"_source" : {
	  "md5" : "85e9e2c4a9c0a7af309c906516aa4548",
	  "strings_api" : "ShellExecuteA" },
	"highlight" : {
	  "strings_api.keyword" : [
		"<em>ShellExecuteA</em>"
	  ]}}
]

```

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 15, 2020, 12:53am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650/2 "2020-12-15T00:53:19Z")

</div>

First based on what doc value though?

---

<div class="post-metadata">

### Author: ![sec\_r\_and\_d](https://avatars.discourse-cdn.com/v4/letter/s/8baadc/32.png) [@sec\_r\_and\_d](https://discuss.elastic.co/u/sec_r_and_d)
#### Post date: [December 15, 2020, 3:41am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650/3 "2020-12-15T03:41:53Z")

</div>

For my use case, it could be based on any doc value (i.e. sorting doesn't matter). If aggregation/bucketing could produce the desired hits, any match from the highlight or (md5 AND index) bucket would do.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 12, 2021, 3:42am UTC](https://discuss.elastic.co/t/getting-unique-results-on-highlight-or-multiple-fields/258650/4 "2021-01-12T03:42:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.