# How to make a query for group by count?

**URL:** <https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776>\
**Category:** Elasticsearch\
**Created:** [July 16, 2019, 3:12pm UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776 "2019-07-16T15:12:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![psyapathy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psyapathy/32/50265_2.png) [@psyapathy](https://discuss.elastic.co/u/psyapathy)\
**Post date:** [July 16, 2019, 3:12pm UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776/1 "2019-07-16T15:12:01Z")

</div>

Hello!  
I looking for information by event\_id 2771

And i get result table (example):  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/0/f0e12a405cac25305896d53b13e34b0f23edf40b.png)

I want to group the data and hide the duplicate TargetUser by their count in table. I want this result:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/84cbb2117a6c71bfd8b88d7ca97761313b07f84d.png)

Is it possible?  
How to make a query for group by count?

Thank you advance

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [July 17, 2019, 5:38am UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776/2 "2019-07-17T05:38:04Z")

</div>

You can try sub-aggregation:

```
 {

      "aggs": {

        "event_id": {

          "terms": {

            "field": "event_id"

          },

          "aggs": {

            "targetUser": {

              "terms": {

                "field": "tragetUser"

              },

              "aggs": {

                "ipAddress": {

                  "terms": {

                    "field": "ipAddress"

                  }

                }

              }

            }

          }

        }

      }

    }
```

---

<div class="post-metadata">

**Author:** ![psyapathy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/psyapathy/32/50265_2.png) [@psyapathy](https://discuss.elastic.co/u/psyapathy)\
**Post date:** [July 17, 2019, 9:39am UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776/3 "2019-07-17T09:39:35Z")

</div>

Thank you. But how i can get column Count with count of TargetUser?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2019, 9:47am UTC](https://discuss.elastic.co/t/how-to-make-a-query-for-group-by-count/190776/4 "2019-08-14T09:47:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.