# How to count the quantity of documents?

**URL:** <https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522>\
**Category:** Elasticsearch\
**Created:** [December 29, 2017, 4:27am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522 "2017-12-29T04:27:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 29, 2017, 4:27am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/1 "2017-12-29T04:27:32Z")

</div>

this is my restful api:  
I want to sum the document(total),besides the protocol 17 and 6 .  
How can I do.  
"Udp|Tcp" : {  
"terms" : {  
"field" : "PROTOCOL",  
"include" : ["17", "6"]  
}  
}  
response:  
"Udp|Tcp": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 0,  
"buckets": [  
{  
"key": 6,  
"doc\_count": 60  
},  
{  
"key": 17,  
"doc\_count": 8  
}  
]  
}  
thank you in adcance!

---

<div class="post-metadata">

**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\
**Post date:** [December 29, 2017, 6:36am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/2 "2017-12-29T06:36:01Z")

</div>

Hi 張皓翔,

Does the following query achieve your goal? It returns the sum of documents that have either a `PROTOCOL` value of `6` or `17` in the total hits from the query part, and then spells out the number of documents in each bucket in the aggregation part separately.

```auto
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "terms": {
            "PROTOCOL": [
              "6",
              "17"
            ]
          }
        }
      ]
    }
  }, 
  "aggs": {
    "Udp|Tcp": {
      "terms": {
        "field": "PROTOCOL",
        "include": ["6", "17"], 
        "size": 2
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 29, 2017, 6:45am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/3 "2017-12-29T06:45:37Z")

</div>

could I return the total documents counts, instead of only the protocol 6 and 17?

thank you in advance!

---

<div class="post-metadata">

**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\
**Post date:** [December 29, 2017, 6:53am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/4 "2017-12-29T06:53:59Z")

</div>

Yes, just replace the `must` query with a `match_all` query:

```auto
  "query": {
    "match_all": {}
  }, 

```

You can also leave out the query block completely. Without the query block, the response will still contain the total number of documents the aggregation is based on.

---

<div class="post-metadata">

**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Post date:** [December 30, 2017, 11:15am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/5 "2017-12-30T11:15:06Z")

</div>

now this is my Restful API:

```
GET logstash-2017.12.30/_search
{
"_source": {
  "includes": ["FIRST_SWITCHED", "LAST_SWITCHED","IPV4_DST_ADDR","L4_DST_PORT","IPV4_SRC_ADDR","L7_PROTO_NAME","PROTOCOL"]
},
"from" : 0, "size" : 0,
"query": {
"bool": {
 "should": [
    {
        "term":{"IPV4_DST_ADDR":"192.168.0.159"}
    },
    {
        "term":{"IPV4_SRC_ADDR":"192.168.0.159"}
    }
  ],
  "minimum_should_match": 1,
  "must":
    {
      "range" : {
        "LAST_SWITCHED" : {
            "gte" : 1514631927
        }
        }
    }
}
},
"aggs": {
    "Udp|Tcp" : {
         "terms" : {
             "field" : "PROTOCOL",
             "include" : ["17", "6"]      
            }
  },"OtherSessions":{
       "terms" : {
             "field" : "PROTOCOL",
             "exclude" : ["17", "6"]      
            }
    
  }
}
}

```

and the response documents such like:

```
 "aggregations": {
"Udp|Tcp": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": 6,
      "doc_count": 34
    },
    {
      "key": 17,
      "doc_count": 34
    }
  ]
},
"OtherSessions": {
  "doc_count_error_upper_bound": 0,
  "sum_other_doc_count": 0,
  "buckets": [
    {
      "key": 2,
      "doc_count": 3
    },
    {
      "key": 1,
      "doc_count": 2
    }
  ]
}

```

and my goal is:  
"buckets": [  
{  
"key": 6,  
"doc\_count": 34  
},  
{  
"key": 17,  
"doc\_count": 34  
},  
"others"  
"doc\_count":xxx  
]  
need not list other key except 17 and 6.  
thank you in advance 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 27, 2018, 11:15am UTC](https://discuss.elastic.co/t/how-to-count-the-quantity-of-documents/113522/6 "2018-01-27T11:15:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.