# Show positive hits in data-table?

**URL:** <https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417>\
**Category:** Kibana\
**Created:** [August 1, 2017, 9:03pm UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417 "2017-08-01T21:03:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramon\_Zaro](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Ramon\_Zaro](https://discuss.elastic.co/u/Ramon_Zaro)\
**Post date:** [August 1, 2017, 9:03pm UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417/1 "2017-08-01T21:03:57Z")

</div>

Hi all,  
I am implementing a filesearch solution using fscrawler to feed data to ES.

my use case is :

1. search for multiple search strings simultaneously, say "term1, term2, term3"
2. let's say term1 occurs in file1 & file2, term2 only in file3 and term3 is not found in index.
3. I would like to display this in a tabular form displaying 'search string' : 'file(s) found in' pairs
4. for the above example it would show :  
term1 : file1, file2  
term2 : file3  
term3 : not found

is it possible to do this currently in kibana ?

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [August 1, 2017, 10:34pm UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417/2 "2017-08-01T22:34:41Z")

</div>

You might be able to make something work with the data table visualization.

Use the filters aggregation as your first bucket and create a filter for each term you're searching for and use the terms aggregation on your filename field as a sub-bucket. The terms aggregation returns the top n values for the field you specify, so if the expected number of field names is low you could just set the `size` parameter to whatever you think would be the max cardinality.

You'll end up with something that looks like this (with different field names, of course):

 ![42 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/5/458d5cdfd91b26fdfd8e0a6c63327d2c006a6fe5.png)

You get a row for each term/filename combination, but that's just how the data table works. Depending on what your data looks like, you might be able to get away with using the Top Hit metric instead of a terms agg sub bucket to concatenate the field names from some top-n results.

---

<div class="post-metadata">

**Author:** ![Ramon\_Zaro](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Ramon\_Zaro](https://discuss.elastic.co/u/Ramon_Zaro)\
**Post date:** [August 2, 2017, 3:22am UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417/3 "2017-08-02T03:22:21Z")

</div>

thanks matt !

if I understood you correctly, filter for each search term has to be created individually. this is ok when you know beforehand what the seach terms are going to be (like response code in your example).

In my case, the search terms are not known previously and also the number of terms may be quite large, 10-15 at least. so creating individual filters every time is not practical. I would like to save a visualization which can run on whatever search query I run.

is there a way to aggregate search terms on the basis of if they have returned a hit or not ?  
even something like  
term1 - yes  
term2 - yes  
term3 - no  
.  
.  
.  
termN - no

will do very well for me.

thanks again.

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [August 10, 2017, 2:25pm UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417/4 "2017-08-10T14:25:27Z")

</div>

@Ramon_Zaro sorry if I'm misunderstanding, but it sounds like you just need a terms agg with `min_doc_count` set to 0. This will return terms even if they have 0 matches for the current query.

 ![04 AM](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da2a37e5c979726168c7eb81a2aa76308cc53634.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2017, 2:25pm UTC](https://discuss.elastic.co/t/show-positive-hits-in-data-table/95417/5 "2017-09-07T14:25:31Z")

</div>

Closed on September 7, 2017, 2:25pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.