# Lookup value in terms facet

**URL:** <https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761>\
**Category:** Elasticsearch\
**Created:** [December 8, 2013, 1:19pm UTC](https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761 "2013-12-08T13:19:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Simon\_Woodhead](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@Simon\_Woodhead](https://discuss.elastic.co/u/Simon_Woodhead)\
**Post date:** [December 8, 2013, 1:19pm UTC](https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761/1 "2013-12-08T13:19:55Z")

</div>

hi folks,

I'm pretty new to elasticsearch but loving it and seeing loads of potential  
use cases for it. I have some dummy data going into it and some great  
Kibana visualisations of it.

However, one issue I'm struggling with in output (and thus Kibana charts)  
is lookup values and would appreciate some pointers.

We have data like

{"key":"123","value":"some human readable text that is usually but not 100%  
consistent"}

I can do terms facets on the key and they work as expected. I can't do them  
on the 'value' for two reasons:

- the results are split by space (but I understand this could be resolved)
- the value may change over time whereas the key never will

Is there a lightweight way to facet on the key but output one of the values  
(most recent if there's control)?

If I've confused all of that, all I want is the human readable part as  
legend on charts rather than the key 🙂

Thanks in advance for any help,  
Simon

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\
**Post date:** [December 9, 2013, 5:30am UTC](https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761/2 "2013-12-09T05:30:15Z")

</div>

Look at the terms stats facet which would allow you to change with field is  
used for the value:

> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.

You can ignore the other statistics if you just want the count. For best  
results, the value should be on a non-analyzed field.

--  
Ivan

On Sun, Dec 8, 2013 at 5:19 AM, Simon W [woodheads@gmail.com](mailto:woodheads@gmail.com) wrote:

> hi folks,
> 
> I'm pretty new to elasticsearch but loving it and seeing loads of  
> potential use cases for it. I have some dummy data going into it and some  
> great Kibana visualisations of it.
> 
> However, one issue I'm struggling with in output (and thus Kibana charts)  
> is lookup values and would appreciate some pointers.
> 
> We have data like
> 
> {"key":"123","value":"some human readable text that is usually but not  
> 100% consistent"}
> 
> I can do terms facets on the key and they work as expected. I can't do  
> them on the 'value' for two reasons:
> 
> - the results are split by space (but I understand this could be resolved)
> - the value may change over time whereas the key never will
> 
> Is there a lightweight way to facet on the key but output one of the  
> values (most recent if there's control)?
> 
> If I've confused all of that, all I want is the human readable part as  
> legend on charts rather than the key 🙂
> 
> Thanks in advance for any help,  
> Simon
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com)  
> .  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0\_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Simon\_Woodhead](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@Simon\_Woodhead](https://discuss.elastic.co/u/Simon_Woodhead)\
**Post date:** [December 9, 2013, 10:38am UTC](https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761/3 "2013-12-09T10:38:28Z")

</div>

Hi Ivan

Thanks for that, yep, that looks like it solves the problem. Can’t see it anywhere in Kibana but it helps for direct queries.

cheers  
Simon

On 9 Dec 2013, at 05:30, Ivan Brusic [ivan@brusic.com](mailto:ivan@brusic.com) wrote:

> Look at the terms stats facet which would allow you to change with field is used for the value:
> 
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-facets-terms-stats-facet.html)
> 
> You can ignore the other statistics if you just want the count. For best results, the value should be on a non-analyzed field.
> 
> --  
> Ivan
> 
> On Sun, Dec 8, 2013 at 5:19 AM, Simon W [woodheads@gmail.com](mailto:woodheads@gmail.com) wrote:  
> hi folks,
> 
> I'm pretty new to elasticsearch but loving it and seeing loads of potential use cases for it. I have some dummy data going into it and some great Kibana visualisations of it.
> 
> However, one issue I'm struggling with in output (and thus Kibana charts) is lookup values and would appreciate some pointers.
> 
> We have data like
> 
> {"key":"123","value":"some human readable text that is usually but not 100% consistent"}
> 
> I can do terms facets on the key and they work as expected. I can't do them on the 'value' for two reasons:
> 
> - the results are split by space (but I understand this could be resolved)
> - the value may change over time whereas the key never will
> 
> Is there a lightweight way to facet on the key but output one of the values (most recent if there's control)?
> 
> If I've confused all of that, all I want is the human readable part as legend on charts rather than the key 🙂
> 
> Thanks in advance for any help,  
> Simon
> 
> --  
> You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7433aa9a-3511-47ba-b249-8b6743402b69%40googlegroups.com).  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
> 
> --  
> You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group.  
> To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/moMI20NqG1w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/moMI20NqG1w/unsubscribe).  
> To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0\_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQDLnJroFpL%2BBtztXKcyWLPQH0_%3Drt86ye-nUXTukat%3DJA%40mail.gmail.com).  
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/01D9A55E-1370-426D-9F68-9445781433A4%40gmail.com](https://groups.google.com/d/msgid/elasticsearch/01D9A55E-1370-426D-9F68-9445781433A4%40gmail.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:02am UTC](https://discuss.elastic.co/t/lookup-value-in-terms-facet/14761/4 "2017-07-06T02:02:32Z")

</div>


