# How can i aggregate data by an field?

**URL:** <https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216>\
**Category:** Elasticsearch\
**Created:** [March 30, 2018, 10:31am UTC](https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216 "2018-03-30T10:31:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [March 30, 2018, 10:31am UTC](https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216/1 "2018-03-30T10:31:01Z")

</div>

Time MSG PayID PayResult  
March 28th 2018, 23:35:47.295 PayResult 24C49884-6DF5-4216-90DD-FD3E7D594C94 Leave  
March 28th 2018, 23:35:21.901 PayResult 09895841-AADC-4F2C-88A2-6624070802A9 Leave  
March 28th 2018, 23:32:33.014 PayResult B0D4B5FF-3936-40FB-B041-8341DF38631E Success  
March 28th 2018, 23:32:24.384 PayResult B0D4B5FF-3936-40FB-B041-8341DF38631E Cancel  
March 28th 2018, 23:32:02.522 PayResult A7D6DEB1-5030-4CB0-A357-F14D15E0CBAC Leave  
March 28th 2018, 23:31:59.354 PayResult A7D6DEB1-5030-4CB0-A357-F14D15E0CBAC Cancel  
March 28th 2018, 23:29:53.692 PayResult FF2BC98D-DB44-4232-8D4F-46EB9A4EAEE8 Leave  
March 28th 2018, 23:29:22.945 PayResult DAFF8C9A-A16E-413E-A261-CF5FF9048465 Leave  
March 28th 2018, 23:29:07.025 PayResult 092BB593-6A70-4DDC-9493-97F9FCF2B4A0 Leave  
if the PayResult is Success i needn't cancel and leave i hope when i statistics or Aggregations use the lastest PayResult

---

<div class="post-metadata">

**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\
**Post date:** [March 30, 2018, 12:50pm UTC](https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216/2 "2018-03-30T12:50:45Z")

</div>

I'm not sure I understand what you want to do.  
You can aggregate strings only in keyword format. If you didn't map PayResult as keyword, then use `PayResult.keyword` in your visualization.  
If you mapped it as keyword (which you should in my opinion, because the field seems to have a discrete number of single string values), then just use `PayResult`.  
Then in your search you can use `PayResult:"Success"` (or `PayResult.keyword:"Success"`), if you want to see only Success events.  
Or negate it if you want to see every event but those: `-PayResult:"Success"` (`-PayResult.keyword:"Success"`).

---

<div class="post-metadata">

**Author:** ![chenzilong444](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\
**Post date:** [April 2, 2018, 8:00am UTC](https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216/3 "2018-04-02T08:00:42Z")

</div>

thank you  
but i mean when two events have the same ID ，if PayResult is Success and cancel ，so when i statistics how many success and how many cancel， they will all be counted，so i need A ID has only one final result ，The success is higher than the cancellation weight, and the cancellation is higher than the leave weight.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2018, 8:00am UTC](https://discuss.elastic.co/t/how-can-i-aggregate-data-by-an-field/126216/4 "2018-04-30T08:00:48Z")

</div>

Closed on April 30, 2018, 8:00am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.