# Table for successful icmp counts **URL:** \ **Category:** Beats\ **Tags:** heartbeat\ **Created:** [June 21, 2019, 4:38am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794 "2019-06-21T04:38:34Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![noairbag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noairbag/32/48487_2.png) [@noairbag](https://discuss.elastic.co/u/noairbag)\ **Post date:** [June 21, 2019, 4:38am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/1 "2019-06-21T04:38:34Z")
How can I create a table that shows the number of successful ICMP pings to each server (10 in total)? Context: this is for a game; as long as teams keep their networks up, the pings to their servers will be successful. At the end, whichever team has the highest number of successful pings, wins. ---
**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Post date:** [June 24, 2019, 5:56pm UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/2 "2019-06-24T17:56:52Z")
You'll want to create a terms aggregation with `monitor.ip` as the bucket, and then filter by `monitor.status: up`. Alternatively, you could create a terms agg with `monitor.ip` as the bucket, and a second bucket using `monitor.status`, which would show both the up and down values. ---
**Author:** ![noairbag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noairbag/32/48487_2.png) [@noairbag](https://discuss.elastic.co/u/noairbag)\ **Post date:** [June 25, 2019, 12:32am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/3 "2019-06-25T00:32:18Z")
Thanks Andrew. I tried this on a few hosts - they all counted up to '90' and stopped. When I took one of the hosts down, the count began to decrease for that host. How can I count **all** pings? If I run 1,000 ping checks successfully against a host, I want the count value to read 1,000. If 1 out of 1,000 ping checks fail, it should read 999. ---
**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Post date:** [June 25, 2019, 3:05am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/4 "2019-06-25T03:05:52Z")
Did you check the time picker? It might not be covering a long enough range and 90 might be the number that fits in the selected range. ---
**Author:** ![noairbag](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noairbag/32/48487_2.png) [@noairbag](https://discuss.elastic.co/u/noairbag)\ **Post date:** [June 25, 2019, 2:38pm UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/5 "2019-06-25T14:38:28Z")
Yes, that worked. One last question: is there an API to manipulate the count for a particular ip? For example, 10.1.1.1 has a count of 6,000 and I'd like to decrement it by 100. ---
**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Post date:** [June 28, 2019, 11:34am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/6 "2019-06-28T11:34:57Z")
No, short of deleting documents manually in ES ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2019, 11:35am UTC](https://discuss.elastic.co/t/table-for-successful-icmp-counts/186794/7 "2019-07-26T11:35:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.