# Term facet : Grouping of multiple field **URL:** \ **Category:** Elasticsearch\ **Created:** [December 11, 2013, 10:08am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812 "2013-12-11T10:08:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [December 11, 2013, 10:08am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/1 "2013-12-11T10:08:10Z")
This is my data in elasticsearch Action : "added" Product\_ID : 123 Action : "added" Product\_ID : 124 Action : "removed" Product\_ID : 124 Action : "purchased" Product\_ID : 123 Action : "added" Product\_ID : 123 I want to find number of times product added or removed per product\_ID. I have used _term\_facet_ for grouping by product\_ID. My query is curl -XGET '[http://localhost:9200/logstash-2013.12.04/\_search?pretty=true](http://localhost:9200/logstash-2013.12.04/_search?pretty=true)' -d '{ "query" : { "terms" :{"activity" : ["added","removed"]} }, "facets" : { "productID" : { "terms" : { "field" : "product\_ID" } } } }' But it shows combined count of added and removed like for \*produc id 123 \*it shows _count = 2_. I want like, for _product id 123_ it should show like \*added = 2 \*and _removed =0_. Am I missing something in my facet query or some other query will work? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/46534a7e-f519-4d04-bb5b-59961f5b0b96%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/46534a7e-f519-4d04-bb5b-59961f5b0b96%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![paul1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul1/32/46819_2.png) [@paul1](https://discuss.elastic.co/u/paul1)\ **Post date:** [December 11, 2013, 10:30am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/2 "2013-12-11T10:30:02Z")
If the structure is stored as nested type then you can do a nested query. "query": { "nested": { "path": "your path", "query": { "bool": { "must": [ { "match": { "your path.Action": { "query": "added" } } }, { "match": { "your path.Product\_ID ": { "query": "123" } } } ] } } } } Then do a facet on this On Wednesday, 11 December 2013 15:38:10 UTC+5:30, abhi patel wrote: > This is my data in elasticsearch > > Action : "added" Product\_ID : 123 > Action : "added" Product\_ID : 124 > Action : "removed" Product\_ID : 124 > Action : "purchased" Product\_ID : 123 > Action : "added" Product\_ID : 123 > > I want to find number of times product added or removed per product\_ID. > > I have used _term\_facet_ for grouping by product\_ID. > > My query is > > curl -XGET '[http://localhost:9200/logstash-2013.12.04/\_search?pretty=true](http://localhost:9200/logstash-2013.12.04/_search?pretty=true)' > -d '{ > "query" : { > "terms" :{"activity" : ["added","removed"]} > }, > "facets" : { > "productID" : { > "terms" : { > "field" : "product\_ID" > } > } > } > }' > > But it shows combined count of added and removed like for \*produc id 123 \*it > shows _count = 2_. > > I want like, for _product id 123_ it should show like \*added = 2 \*and _removed > =0_. > > Am I missing something in my facet query or some other query will work? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/058be085-84f4-4abf-81b7-b8d4f082c1df%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/058be085-84f4-4abf-81b7-b8d4f082c1df%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [December 11, 2013, 10:34am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/3 "2013-12-11T10:34:39Z")
Thanks paul. Can you just brief what is path means? On Wednesday, December 11, 2013 4:00:02 PM UTC+5:30, paul wrote: > If the structure is stored as nested type then you can do a nested query. > > "query": { > "nested": { > "path": "your path", > "query": { > "bool": { > "must": [ > { > "match": { > "your path.Action": { > "query": "added" > } > } > }, > { > "match": { > "your path.Product\_ID ": { > "query": "123" > } > } > } > ] > } > } > } > } > > Then do a facet on this > > On Wednesday, 11 December 2013 15:38:10 UTC+5:30, abhi patel wrote: > > > This is my data in elasticsearch > > > > Action : "added" Product\_ID : 123 > > Action : "added" Product\_ID : 124 > > Action : "removed" Product\_ID : 124 > > Action : "purchased" Product\_ID : 123 > > Action : "added" Product\_ID : 123 > > > > I want to find number of times product added or removed per product\_ID. > > > > I have used _term\_facet_ for grouping by product\_ID. > > > > My query is > > > > curl -XGET '[http://localhost:9200/logstash-2013.12.04/\_search?pretty=true](http://localhost:9200/logstash-2013.12.04/_search?pretty=true)' > > -d '{ > > "query" : { > > "terms" :{"activity" : ["added","removed"]} > > }, > > "facets" : { > > "productID" : { > > "terms" : { > > "field" : "product\_ID" > > } > > } > > } > > }' > > > > But it shows combined count of added and removed like for \*produc id 123 > > \*it shows _count = 2_. > > > > I want like, for _product id 123_ it should show like \*added = 2 \*and _removed > > =0_. > > > > Am I missing something in my facet query or some other query will work? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b4a46391-f465-41e9-9b24-389092567dd9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b4a46391-f465-41e9-9b24-389092567dd9%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![paul1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul1/32/46819_2.png) [@paul1](https://discuss.elastic.co/u/paul1)\ **Post date:** [December 11, 2013, 10:41am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/4 "2013-12-11T10:41:23Z")
For the data below { "name":"ABC", "results":[ { "Action":"added", "Product\_ID":124 }, { "Action":"added", "Product\_ID":123 }, { "Action":"removed", "Product\_ID":123 }, { "Action":"removed", "Product\_ID":124 } ] } path is results On Wednesday, 11 December 2013 16:04:39 UTC+5:30, abhi patel wrote: > Thanks paul. Can you just brief what is path means? > > On Wednesday, December 11, 2013 4:00:02 PM UTC+5:30, paul wrote: > > > If the structure is stored as nested type then you can do a nested query. > > > > "query": { > > "nested": { > > "path": "your path", > > "query": { > > "bool": { > > "must": [ > > { > > "match": { > > "your path.Action": { > > "query": "added" > > } > > } > > }, > > { > > "match": { > > "your path.Product\_ID ": { > > "query": "123" > > } > > } > > } > > ] > > } > > } > > } > > } > > > > Then do a facet on this > > > > On Wednesday, 11 December 2013 15:38:10 UTC+5:30, abhi patel wrote: > > > > > This is my data in elasticsearch > > > > > > Action : "added" Product\_ID : 123 > > > Action : "added" Product\_ID : 124 > > > Action : "removed" Product\_ID : 124 > > > Action : "purchased" Product\_ID : 123 > > > Action : "added" Product\_ID : 123 > > > > > > I want to find number of times product added or removed per product\_ID. > > > > > > I have used _term\_facet_ for grouping by product\_ID. > > > > > > My query is > > > > > > curl -XGET ' > > > [http://localhost:9200/logstash-2013.12.04/\_search?pretty=true](http://localhost:9200/logstash-2013.12.04/_search?pretty=true)' -d '{ > > > "query" : { > > > "terms" :{"activity" : ["added","removed"]} > > > }, > > > "facets" : { > > > "productID" : { > > > "terms" : { > > > "field" : "product\_ID" > > > } > > > } > > > } > > > }' > > > > > > But it shows combined count of added and removed like for \*produc id > > > 123 \*it shows _count = 2_. > > > > > > I want like, for _product id 123_ it should show like \*added = 2 \*and _removed > > > =0_. > > > > > > Am I missing something in my facet query or some other query will work? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f4776c36-1d12-4889-9c2e-9f97c1554be6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f4776c36-1d12-4889-9c2e-9f97c1554be6%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![abhiage](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@abhiage](https://discuss.elastic.co/u/abhiage)\ **Post date:** [December 11, 2013, 10:54am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/5 "2013-12-11T10:54:02Z")
Got It.. Actually I have imported above data through logstash and mapping is created automatically by logstash which is not nested type. Any other way to get desired output? On Wednesday, December 11, 2013 4:11:23 PM UTC+5:30, paul wrote: > For the data below > > { > "name":"ABC", > "results":[ > { > "Action":"added", > "Product\_ID":124 > }, > { > "Action":"added", > "Product\_ID":123 > }, > { > "Action":"removed", > "Product\_ID":123 > }, > { > "Action":"removed", > "Product\_ID":124 > } > ] > } > path is results > > On Wednesday, 11 December 2013 16:04:39 UTC+5:30, abhi patel wrote: > > > Thanks paul. Can you just brief what is path means? > > > > On Wednesday, December 11, 2013 4:00:02 PM UTC+5:30, paul wrote: > > > > > If the structure is stored as nested type then you can do a nested query. > > > > > > "query": { > > > "nested": { > > > "path": "your path", > > > "query": { > > > "bool": { > > > "must": [ > > > { > > > "match": { > > > "your path.Action": { > > > "query": "added" > > > } > > > } > > > }, > > > { > > > "match": { > > > "your path.Product\_ID ": { > > > "query": "123" > > > } > > > } > > > } > > > ] > > > } > > > } > > > } > > > } > > > > > > Then do a facet on this > > > > > > On Wednesday, 11 December 2013 15:38:10 UTC+5:30, abhi patel wrote: > > > > > > > This is my data in elasticsearch > > > > > > > > Action : "added" Product\_ID : 123 > > > > Action : "added" Product\_ID : 124 > > > > Action : "removed" Product\_ID : 124 > > > > Action : "purchased" Product\_ID : 123 > > > > Action : "added" Product\_ID : 123 > > > > > > > > I want to find number of times product added or removed per product\_ID. > > > > > > > > I have used _term\_facet_ for grouping by product\_ID. > > > > > > > > My query is > > > > > > > > curl -XGET ' > > > > [http://localhost:9200/logstash-2013.12.04/\_search?pretty=true](http://localhost:9200/logstash-2013.12.04/_search?pretty=true)' -d '{ > > > > "query" : { > > > > "terms" :{"activity" : ["added","removed"]} > > > > }, > > > > "facets" : { > > > > "productID" : { > > > > "terms" : { > > > > "field" : "product\_ID" > > > > } > > > > } > > > > } > > > > }' > > > > > > > > But it shows combined count of added and removed like for \*produc id > > > > 123 \*it shows _count = 2_. > > > > > > > > I want like, for _product id 123_ it should show like \*added = 2 \*and _removed > > > > =0_. > > > > > > > > Am I missing something in my facet query or some other query will work? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2005be02-3c3f-4d1e-a79f-e67938f1190b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2005be02-3c3f-4d1e-a79f-e67938f1190b%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![vaidik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaidik/32/1134_2.png) [@vaidik](https://discuss.elastic.co/u/vaidik)\ **Post date:** [January 4, 2014, 1:18pm UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/6 "2014-01-04T13:18:51Z")
You may want to use Term Script Facets - > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Vaidik Kapoor vaidikkapoor.info On 11 December 2013 16:24, abhi patel [abhiage@gmail.com](mailto:abhiage@gmail.com) wrote: > Got It.. Actually I have imported above data through logstash and mapping > is created automatically by logstash which is not nested type. > Any other way to get desired output? > > On Wednesday, December 11, 2013 4:11:23 PM UTC+5:30, paul wrote: > > > For the data below > > > > { > > "name":"ABC", > > "results":[ > > { > > "Action":"added", > > "Product\_ID":124 > > }, > > { > > "Action":"added", > > "Product\_ID":123 > > }, > > { > > "Action":"removed", > > "Product\_ID":123 > > }, > > { > > "Action":"removed", > > "Product\_ID":124 > > } > > ] > > } > > path is results > > > > On Wednesday, 11 December 2013 16:04:39 UTC+5:30, abhi patel wrote: > > > > > Thanks paul. Can you just brief what is path means? > > > > > > On Wednesday, December 11, 2013 4:00:02 PM UTC+5:30, paul wrote: > > > > > > > If the structure is stored as nested type then you can do a nested > > > > query. > > > > > > > > "query": { > > > > "nested": { > > > > "path": "your path", > > > > "query": { > > > > "bool": { > > > > "must": [ > > > > { > > > > "match": { > > > > "your path.Action": { > > > > "query": "added" > > > > } > > > > } > > > > }, > > > > { > > > > "match": { > > > > "your path.Product\_ID ": { > > > > "query": "123" > > > > } > > > > } > > > > } > > > > ] > > > > } > > > > } > > > > } > > > > } > > > > > > > > Then do a facet on this > > > > > > > > On Wednesday, 11 December 2013 15:38:10 UTC+5:30, abhi patel wrote: > > > > > > > > > This is my data in elasticsearch > > > > > > > > > > Action : "added" Product\_ID : 123 > > > > > Action : "added" Product\_ID : 124 > > > > > Action : "removed" Product\_ID : 124 > > > > > Action : "purchased" Product\_ID : 123 > > > > > Action : "added" Product\_ID : 123 > > > > > > > > > > I want to find number of times product added or removed per product\_ID. > > > > > > > > > > I have used _term\_facet_ for grouping by product\_ID. > > > > > > > > > > My query is > > > > > > > > > > curl -XGET '[http://localhost:9200/logstash-2013.12.04/\_search](http://localhost:9200/logstash-2013.12.04/_search)? > > > > > pretty=true' -d '{ > > > > > "query" : { > > > > > "terms" :{"activity" : ["added","removed"]} > > > > > }, > > > > > "facets" : { > > > > > "productID" : { > > > > > "terms" : { > > > > > "field" : "product\_ID" > > > > > } > > > > > } > > > > > } > > > > > }' > > > > > > > > > > But it shows combined count of added and removed like for \*produc id > > > > > 123 \*it shows _count = 2_. > > > > > > > > > > I want like, for _product id 123_ it should show like \*added = 2 \*and > > > > > _removed =0_. > > > > > > > > > > Am I missing something in my facet query or some other query will work? > > > > > > > > -- > > > > You received this message because you are subscribed to the Google Groups > > > > "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send an > > > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > > To view this discussion on the web visit > > > > [https://groups.google.com/d/msgid/elasticsearch/2005be02-3c3f-4d1e-a79f-e67938f1190b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2005be02-3c3f-4d1e-a79f-e67938f1190b%40googlegroups.com) > > > > . > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CACWtv5%3D1Ohjsj6bBS6y6ZbUP-os\_Cz7uzwLxPsZUGSZ-YpOh-w%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CACWtv5%3D1Ohjsj6bBS6y6ZbUP-os_Cz7uzwLxPsZUGSZ-YpOh-w%40mail.gmail.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:58am UTC](https://discuss.elastic.co/t/term-facet-grouping-of-multiple-field/14812/7 "2017-07-06T01:58:22Z")