# Question about term facet on array (with repeated value in array) **URL:** \ **Category:** Elasticsearch\ **Created:** [September 25, 2013, 4:15pm UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756 "2013-09-25T16:15:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![H\_i\_Nguy\_n\_Trung](https://avatars.discourse-cdn.com/v4/letter/h/45deac/32.png) [@H\_i\_Nguy\_n\_Trung](https://discuss.elastic.co/u/H_i_Nguy_n_Trung)\ **Post date:** [September 25, 2013, 4:15pm UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/1 "2013-09-25T16:15:01Z")
Hi all, I am trying to count the tag by using term facet on the following kind of document - kind of tag but one tag can appear in several times instead of one: My doc looks like: { event\_name: "Log\_in", event\_count: ["failed","successful", "failed"] } With this facet { "facets": { "facet\_1": { "terms": { "field": "event\_count" } } } } I only have the result: "terms": [ { "term": "failed", "count": 1 }, { "term": "successful", "count": 1 } ] What I want is the count facet for term "failed" should be 2, according to the document. Is it possible? Please guide me how. Thank. Hai -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![mvg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvg/32/98890_2.png) [@mvg](https://discuss.elastic.co/u/mvg)\ **Post date:** [September 25, 2013, 5:46pm UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/2 "2013-09-25T17:46:19Z")
Hi Hai, The 'count' in the facet response represents the number documents that have a specific term and not the number of times a term is used. The 'failed' count of 1 is expected. You should index each failed or successful login attempt as separate documents (I guess you have more metadata per login attempt): { event\_name: "Log\_in", event\_count: "failed" } { event\_name: "Log\_in", event\_count: "successful" } { event\_name: "Log\_in", event\_count: failed" } On 25 September 2013 18:15, Hải Nguyễn Trung [haint504@gmail.com](mailto:haint504@gmail.com) wrote: > Hi all, > I am trying to count the tag by using term facet on the following kind of > document - kind of tag but one tag can appear in several times instead of > one: > My doc looks like: > { > event\_name: "Log\_in", > event\_count: ["failed","successful", "failed"] > } > > With this facet > { > "facets": { > "facet\_1": { > "terms": { > "field": "event\_count" > } > } > } > } > > I only have the result: > "terms": [ > { > "term": "failed", > "count": 1 > }, > { > "term": "successful", > "count": 1 > } > ] > > What I want is the count facet for term "failed" should be 2, according to > the document. > Is it possible? Please guide me how. > Thank. > Hai > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- Met vriendelijke groet, Martijn van Groningen -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![H\_i\_Nguy\_n\_Trung](https://avatars.discourse-cdn.com/v4/letter/h/45deac/32.png) [@H\_i\_Nguy\_n\_Trung](https://discuss.elastic.co/u/H_i_Nguy_n_Trung)\ **Post date:** [September 25, 2013, 11:10pm UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/3 "2013-09-25T23:10:47Z")
Dear Martin, Thank for your response, That was what i thought before, however I just want to record the number of specific events in periodical manner (saying 1 minute per record), and don't want to use too many documents that may consume more disk space. I also tried nested type: { event\_name: "Log\_in", event\_count: { "failed": 2, "successful": 1 } } But I don't know which kind of query/facet should be used? Thank. On Thursday, September 26, 2013 12:46:19 AM UTC+7, Martijn v Groningen wrote: > Hi Hai, > > The 'count' in the facet response represents the number documents that > have a specific term and not the number of times a term is used. The > 'failed' count of 1 is expected. You should index each failed or successful > login attempt as separate documents (I guess you have more metadata per > login attempt): > { > event\_name: "Log\_in", > event\_count: "failed" > } > { > event\_name: "Log\_in", > event\_count: "successful" > } > { > event\_name: "Log\_in", > event\_count: failed" > } > > On 25 September 2013 18:15, Hải Nguyễn Trung \<[hain...@gmail.com](mailto:hain...@gmail.com)\ > > > wrote: > > > Hi all, > > I am trying to count the tag by using term facet on the following kind of > > document - kind of tag but one tag can appear in several times instead of > > one: > > My doc looks like: > > { > > event\_name: "Log\_in", > > event\_count: ["failed","successful", "failed"] > > } > > > > With this facet > > { > > "facets": { > > "facet\_1": { > > "terms": { > > "field": "event\_count" > > } > > } > > } > > } > > > > I only have the result: > > "terms": [ > > { > > "term": "failed", > > "count": 1 > > }, > > { > > "term": "successful", > > "count": 1 > > } > > ] > > > > What I want is the count facet for term "failed" should be 2, according > > to the document. > > Is it possible? Please guide me how. > > Thank. > > Hai > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > Met vriendelijke groet, > > Martijn van Groningen -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![johtani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johtani/32/44956_2.png) [@johtani](https://discuss.elastic.co/u/johtani)\ **Post date:** [September 26, 2013, 2:27am UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/4 "2013-09-26T02:27:43Z")
Hi Hải, You try to use "statistical facet" for your nested type documents. > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Like following query. { "facets": { "failed\_cnt": { "statistical": { "field": "event\_count.failed" } }, "success\_cnt": { "statistical": { "field": "event\_count.successful" } } } } Isn't "total" in the response that you want? * * * Jun Ohtani [johtani@gmail.com](mailto:johtani@gmail.com) twitter : [http://twitter.com/johtani](http://twitter.com/johtani) On 2013/09/26, at 8:10, Hải Nguyễn Trung [haint504@gmail.com](mailto:haint504@gmail.com) wrote: > Dear Martin, > Thank for your response, > That was what i thought before, however I just want to record the number of specific events in periodical manner (saying 1 minute per record), and don't want to use too many documents that may consume more disk space. > I also tried nested type: > { > event\_name: "Log\_in", > event\_count: > { > "failed": 2, > "successful": 1 > } > } > But I don't know which kind of query/facet should be used? > Thank. > > On Thursday, September 26, 2013 12:46:19 AM UTC+7, Martijn v Groningen wrote: > Hi Hai, > > The 'count' in the facet response represents the number documents that have a specific term and not the number of times a term is used. The 'failed' count of 1 is expected. You should index each failed or successful login attempt as separate documents (I guess you have more metadata per login attempt): > { > event\_name: "Log\_in", > event\_count: "failed" > } > { > event\_name: "Log\_in", > event\_count: "successful" > } > { > event\_name: "Log\_in", > event\_count: failed" > } > > On 25 September 2013 18:15, Hải Nguyễn Trung [hain...@gmail.com](mailto:hain...@gmail.com) wrote: > Hi all, > I am trying to count the tag by using term facet on the following kind of document - kind of tag but one tag can appear in several times instead of one: > My doc looks like: > { > event\_name: "Log\_in", > event\_count: ["failed","successful", "failed"] > } > > With this facet > { > "facets": { > "facet\_1": { > "terms": { > "field": "event\_count" > } > } > } > } > > I only have the result: > "terms": [ > { > "term": "failed", > "count": 1 > }, > { > "term": "successful", > "count": 1 > } > ] > > What I want is the count facet for term "failed" should be 2, according to the document. > Is it possible? Please guide me how. > Thank. > Hai > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > -- > Met vriendelijke groet, > > Martijn van Groningen > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![H\_i\_Nguy\_n\_Trung](https://avatars.discourse-cdn.com/v4/letter/h/45deac/32.png) [@H\_i\_Nguy\_n\_Trung](https://discuss.elastic.co/u/H_i_Nguy_n_Trung)\ **Post date:** [September 26, 2013, 2:44am UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/5 "2013-09-26T02:44:11Z")
Hi Jun, I tried your search query, that is exactly what I need. Thank you for your help. Hai On Thursday, September 26, 2013 9:27:43 AM UTC+7, Jun Ohtani wrote: > Hi Hải, > > You try to use "statistical facet" for your nested type documents. > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/api/search/facets/statistical-facet/) > > Like following query. > { > "facets": { > "failed\_cnt": { > "statistical": { > "field": "event\_count.failed" > } > }, > "success\_cnt": { > "statistical": { > "field": "event\_count.successful" > } > } > } > } > > Isn't "total" in the response that you want? > > * * * > > Jun Ohtani > [joh...@gmail.com](mailto:joh...@gmail.com) \ > twitter : [http://twitter.com/johtani](http://twitter.com/johtani) > > On 2013/09/26, at 8:10, Hải Nguyễn Trung \<[hain...@gmail.com](mailto:hain...@gmail.com) \\> > wrote: > > > Dear Martin, > > Thank for your response, > > That was what i thought before, however I just want to record the number > > of specific events in periodical manner (saying 1 minute per record), and > > don't want to use too many documents that may consume more disk space. > > I also tried nested type: > > { > > event\_name: "Log\_in", > > event\_count: > > { > > "failed": 2, > > "successful": 1 > > } > > } > > But I don't know which kind of query/facet should be used? > > Thank. > > > > On Thursday, September 26, 2013 12:46:19 AM UTC+7, Martijn v Groningen > > wrote: > > Hi Hai, > > > > The 'count' in the facet response represents the number documents that > > have a specific term and not the number of times a term is used. The > > 'failed' count of 1 is expected. You should index each failed or successful > > login attempt as separate documents (I guess you have more metadata per > > login attempt): > > { > > event\_name: "Log\_in", > > event\_count: "failed" > > } > > { > > event\_name: "Log\_in", > > event\_count: "successful" > > } > > { > > event\_name: "Log\_in", > > event\_count: failed" > > } > > > > On 25 September 2013 18:15, Hải Nguyễn Trung [hain...@gmail.com](mailto:hain...@gmail.com) wrote: > > Hi all, > > I am trying to count the tag by using term facet on the following kind > > of document - kind of tag but one tag can appear in several times instead > > of one: > > My doc looks like: > > { > > event\_name: "Log\_in", > > event\_count: ["failed","successful", "failed"] > > } > > > > With this facet > > { > > "facets": { > > "facet\_1": { > > "terms": { > > "field": "event\_count" > > } > > } > > } > > } > > > > I only have the result: > > "terms": [ > > { > > "term": "failed", > > "count": 1 > > }, > > { > > "term": "successful", > > "count": 1 > > } > > ] > > > > What I want is the count facet for term "failed" should be 2, according > > to the document. > > Is it possible? Please guide me how. > > Thank. > > Hai > > > > -- > > You received this message because you are subscribed to the Google > > Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). > > > > -- > > Met vriendelijke groet, > > > > Martijn van Groningen > > > > -- > > You received this message because you are subscribed to the Google > > Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:14am UTC](https://discuss.elastic.co/t/question-about-term-facet-on-array-with-repeated-value-in-array/13756/6 "2017-07-06T02:14:39Z")