# Query
**URL:** https://discuss.elastic.co/t/query/115977
**Category:** Elasticsearch
**Created:** [January 18, 2018, 6:42am UTC](https://discuss.elastic.co/t/query/115977 "2018-01-18T06:42:15Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [January 18, 2018, 6:42am UTC](https://discuss.elastic.co/t/query/115977/1 "2018-01-18T06:42:15Z")
hi there!
i am trying to analyze one thing.
scenario:
i have the logs for following actions:
req action 3 times with different id,
resp action 2 times with req id,
if one resp is missing coz' of user close browser
> id:0001 req action
> id:0001 resp action
>
> id:0002 req action
> id:0002 **no resp action** (user close browser)
>
> id:0003 req action
> id:0003 resp action
in this situation, how can i analyze **no resp action count** in kibana visualization?????
has anybody idea for elasticsearch query???
appreciate for any idea.
---
### Author:  [@val](https://discuss.elastic.co/u/val)
#### Post date: [January 18, 2018, 6:49am UTC](https://discuss.elastic.co/t/query/115977/2 "2018-01-18T06:49:36Z")
You can do a [`terms` aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) on the `id` field and sort the buckets using the document count value (ascending). All ids for which there is a single document will come up first in the bucket list.
```
{
"size": 0,
"aggs": {
"exchanges": {
"terms": {
"field": "id",
"order": {
"_count": "asc"
}
}
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2018, 6:49am UTC](https://discuss.elastic.co/t/query/115977/3 "2018-02-15T06:49:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.