# Group by RegExp
**URL:** https://discuss.elastic.co/t/group-by-regexp/64023
**Category:** Elasticsearch
**Created:** [October 26, 2016, 3:25pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023 "2016-10-26T15:25:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@emanuelef](https://discuss.elastic.co/u/emanuelef)
#### Post date: [October 26, 2016, 3:25pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023/1 "2016-10-26T15:25:36Z")
Hi,
I'd need to make query and group the results according to a reg Exp.
For example I have a filed with those possible values:
/sdc/user?id=4039&dc=4
/sdc/user?id=4039&dc=2
/sdc/user?id=2222&dc=7
should give me:
/sdc/user?id=4039 2
/sdc/user?id=2222 1
Is it possible ?
Thanks in advance
---
### Author:  [@polyfractal](https://discuss.elastic.co/u/polyfractal)
#### Post date: [October 26, 2016, 3:42pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023/2 "2016-10-26T15:42:52Z")
You could do it with a [script/value\_script on the terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/search-aggregations-bucket-terms-aggregation.html#_value_script_8), and use the regex functionality that Groovy scripting provides. It won't be super efficient... scripting is a fair amount slower, but it'll work.
A better approach is to try and extract some of that structure ahead of time. Either use an analyzer that breaks those strings into smaller components (then run a terms aggregation to count up the number of `?id=` tokens), or extract `id`, `dc`, etc query params into their own fields, which would allow you to run a terms agg on that directly.
---
### Author:  [@emanuelef](https://discuss.elastic.co/u/emanuelef)
#### Post date: [October 26, 2016, 4:01pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023/3 "2016-10-26T16:01:44Z")
Thanks for the suggestions,
I think the best way would be to extract the query params into fields, and then term agg.
I guess it should be the most efficient.
---
### Author:  [@polyfractal](https://discuss.elastic.co/u/polyfractal)
#### Post date: [October 26, 2016, 4:26pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023/4 "2016-10-26T16:26:36Z")
++ if you can extract them ahead of time, it'd definitely be a lot more efficient. And once they're extracted, you can use it for all kinds of unrelated analysis (top IDs, IDs over time, etc) 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:09pm UTC](https://discuss.elastic.co/t/group-by-regexp/64023/5 "2017-07-05T22:09:24Z")