# I have a lot of transaction record, how can i count total distinct ip address in elasticsearch? **URL:** \ **Category:** Elasticsearch\ **Created:** [December 12, 2013, 4:13am UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833 "2013-12-12T04:13:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bbb\_2](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bbb\_2](https://discuss.elastic.co/u/bbb_2)\ **Post date:** [December 12, 2013, 4:13am UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833/1 "2013-12-12T04:13:42Z")
i have a lot of transaction record, how can i count total distinct ip address in elasticsearch? i've try facet search but it list all distinct ip address, i want only total number of dictinct ip address. thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Jason\_Wee](https://avatars.discourse-cdn.com/v4/letter/j/7ea924/32.png) [@Jason\_Wee](https://discuss.elastic.co/u/Jason_Wee)\ **Post date:** [December 12, 2013, 9:23am UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833/2 "2013-12-12T09:23:00Z")
hmm... facet should work in your situation yes? The example in this link > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. written just like what you seek? "facets" : { "tags" : { "\_type" : "terms", "missing" : 0, "total": 5, "other": 0, "terms" : [ { "term" : "foo", "count" : 2 }, { "term" : "bar", "count" : 2 }, { "term" : "baz", "count" : 1 } ] } } On Thu, Dec 12, 2013 at 12:13 PM, bbb [ibee133@gmail.com](mailto:ibee133@gmail.com) wrote: > i have a lot of transaction record, how can i count total distinct ip > address in elasticsearch? > > i've try facet search but it list all distinct ip address, i want only > total number of dictinct ip address. > > thanks. > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com) > . > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Dan\_Fairs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dan_fairs/32/1205_2.png) [@Dan\_Fairs](https://discuss.elastic.co/u/Dan_Fairs)\ **Post date:** [December 12, 2013, 9:58am UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833/3 "2013-12-12T09:58:19Z")
On 12 Dec 2013, at 09:23, Jason Wee [peichieh@gmail.com](mailto:peichieh@gmail.com) wrote: > hmm... facet should work in your situation yes? The example in this link [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets.html) written just like what you seek? I think the OP in this case wants the total number of distinct IP addresses. I've done this in the past by asking ES for a facet as below with a very large size, and counting the length of the array under the 'terms' key. You'll want to check your memory usage (both in ES and on your client app) though before you do this, as it's a little profligate. Is there a better way to do this with the new aggregations framework coming in 1.0.0? Cheers, Dan > "facets" : { > > "tags" : { > > ``` > "_type" : "terms", > > "missing" : 0, > > "total": 5, > > "other": 0, > > "terms" : [ { > > "term" : "foo", > > "count" : 2 > > }, { > "term" : "bar", > > "count" : 2 > > }, { > "term" : "baz", > > "count" : 1 > > } ] > > ``` > > } > > } > > On Thu, Dec 12, 2013 at 12:13 PM, bbb [ibee133@gmail.com](mailto:ibee133@gmail.com) wrote: > i have a lot of transaction record, how can i count total distinct ip address in elasticsearch? > > i've try facet search but it list all distinct ip address, i want only total number of dictinct ip address. > > thanks. > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- Dan Fairs | [dan.fairs@gmail.com](mailto:dan.fairs@gmail.com) | @danfairs | [secondsync.com](http://secondsync.com) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/80D96C91-2FC2-45CC-95E3-9F33A9D759F8%40gmail.com](https://groups.google.com/d/msgid/elasticsearch/80D96C91-2FC2-45CC-95E3-9F33A9D759F8%40gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [December 13, 2013, 4:24pm UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833/4 "2013-12-13T16:24:07Z")
If you do not need to filter the list, you can get all the terms back for a field with Jorg's termlist plugin: > **[GitHub - jprante/elasticsearch-index-termlist: Elasticsearch Index Termlist](https://github.com/jprante/elasticsearch-index-termlist)** > > Elasticsearch Index Termlist. Contribute to jprante/elasticsearch-index-termlist development by creating an account on GitHub. -- Ivan On Thu, Dec 12, 2013 at 1:58 AM, Dan Fairs [dan.fairs@gmail.com](mailto:dan.fairs@gmail.com) wrote: > On 12 Dec 2013, at 09:23, Jason Wee [peichieh@gmail.com](mailto:peichieh@gmail.com) wrote: > > hmm... facet should work in your situation yes? The example in this link > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets.html) written > just like what you seek? > > I think the OP in this case wants the total number of distinct IP > addresses. I've done this in the past by asking ES for a facet as below > with a very large size, and counting the length of the array under the > 'terms' key. You'll want to check your memory usage (both in ES and on your > client app) though before you do this, as it's a little profligate. > > Is there a better way to do this with the new aggregations framework > coming in 1.0.0? > > Cheers, > Dan > > "facets" : { > > "tags" : { > > ``` > "_type" : "terms", > > "missing" : 0, > > "total": 5, > > "other": 0, > > "terms" : [ { > > "term" : "foo", > > "count" : 2 > > }, { > "term" : "bar", > > "count" : 2 > > }, { > "term" : "baz", > > "count" : 1 > > } ] > > ``` > > } > } > > On Thu, Dec 12, 2013 at 12:13 PM, bbb [ibee133@gmail.com](mailto:ibee133@gmail.com) wrote: > > > i have a lot of transaction record, how can i count total distinct ip > > address in elasticsearch? > > > > i've try facet search but it list all distinct ip address, i want only > > total number of dictinct ip address. > > > > thanks. > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/03a60f63-e7a0-4737-ae83-3964d76da8ac%40googlegroups.com) > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAHO4itxEb9ypVPrZpdZs3qD9DTJc3sXgzLLGJxjrMretGDvPjg%40mail.gmail.com) > . > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > Dan Fairs | [dan.fairs@gmail.com](mailto:dan.fairs@gmail.com) | @danfairs | [secondsync.com](http://secondsync.com) > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/80D96C91-2FC2-45CC-95E3-9F33A9D759F8%40gmail.com](https://groups.google.com/d/msgid/elasticsearch/80D96C91-2FC2-45CC-95E3-9F33A9D759F8%40gmail.com) > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQBsFdBTb-TKBqJYeuhLvPD5Hqipify9ThUjWjOO5rUrYQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQBsFdBTb-TKBqJYeuhLvPD5Hqipify9ThUjWjOO5rUrYQ%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:01am UTC](https://discuss.elastic.co/t/i-have-a-lot-of-transaction-record-how-can-i-count-total-distinct-ip-address-in-elasticsearch/14833/5 "2017-07-06T02:01:17Z")