# Querying log data to get unique error messages

**URL:** <https://discuss.elastic.co/t/querying-log-data-to-get-unique-error-messages/238774>\
**Category:** Elasticsearch\
**Created:** [June 26, 2020, 3:37am UTC](https://discuss.elastic.co/t/querying-log-data-to-get-unique-error-messages/238774 "2020-06-26T03:37:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![N220](https://avatars.discourse-cdn.com/v4/letter/n/3d9bf3/32.png) [@N220](https://discuss.elastic.co/u/N220)\
**Post date:** [June 26, 2020, 3:37am UTC](https://discuss.elastic.co/t/querying-log-data-to-get-unique-error-messages/238774/1 "2020-06-26T03:37:13Z")

</div>

Hi ,  
Issue: To get unique error messages from the logs available in elastic search.  
I have enabled field data as true for text fields.  
my query:

```auto
{
  "query": {
    "bool": {
      "must": [
        {
          "match_phrase": {
            "message": "Error"
          }
        },
        {
          "match_phrase": {
            "type": "lab_source"
          }
        }
      ]
    }
  },
  "aggs": {
    "log_message": {
      "significant_text": {
        "field": "message",
        "filter_duplicate_text": "true"
      }
    }
  },
  "size": 1000
}

```

Error messge example: "..... June 16 23:00:00 ..............Error.."  
The same error message with different timestamps.  
Can anybody help me with the query so that it will return unique error messages and how to get unique text fields?

Thanks !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2020, 3:37am UTC](https://discuss.elastic.co/t/querying-log-data-to-get-unique-error-messages/238774/2 "2020-07-24T03:37:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.