# Top terms in comma separated list **URL:** \ **Category:** Kibana\ **Created:** [July 20, 2017, 1:44pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953 "2017-07-20T13:44:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![snicoll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snicoll/32/20285_2.png) [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Post date:** [July 20, 2017, 1:44pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/1 "2017-07-20T13:44:36Z")
Hey, My index define an attribute "foo" that contains a list of well defined terms (for instance foo, bar, biz, etc). Each document has zero, one or more of those terms. I'd like to better understand how users are using my service and one way to achieve that would be a graph in Kibana that'd show the top 10 terms combination for that field. What is the easiest way to achieve this. I already built a graph on "foo" but that only shows me how frequent a term is used, not how frequent the combination of terms are. Thanks! ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [July 21, 2017, 5:39am UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/2 "2017-07-21T05:39:50Z")
Hey Stéphane, can you help me understand how your data is structured a bit better? Are you saying that each document has a property called "foo", and the value of that property is an array of values, which could consist of "foo", "bar", "biz", etc? ```auto "foo": ["foo", "bar", "biz"] ``` And are you saying you want to see how many users have `"foo": ["foo", "bar"]` vs `"foo": ["bar", "biz"]`? Thanks, CJ ---
**Author:** ![snicoll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snicoll/32/20285_2.png) [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Post date:** [July 21, 2017, 3:15pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/3 "2017-07-21T15:15:32Z")
Hey, Thanks a lot for the reply! So in my document, the attribute `foo` is mapped as a string and when we ingest data we pass a json array of terms. There is a fixed amount of terms (roughly 100 different values). What I am interested is patterns in which those terms are used together. So if the user has selected `foo`, `bar` or `bar`, `foo` that's essentially the same thing (selecting those two values). What I'd like to do indeed is to get a report/visualization of the top "combinations" of those terms (your example above is spot on). Extra request: if I type `dependencies: foo` in the searcher, then I'd like those top combinations to focus on those where `foo` is present . Thanks! ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [July 21, 2017, 5:37pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/4 "2017-07-21T17:37:37Z")
Hi Stéphane, thanks for the explanation! I tried to recreate your use case and here's what I came up with. First, I created a bunch of documents with the `links.raw` property, which is an array of various links (e.g. "[twitter.com](http://twitter.com)", "joe@gmail.com"). Then I created a bar chart visualization with this kind of configuration: ![](https://us1.discourse-cdn.com/elastic/original/3X/6/2/627eac0914ddadfd2ad0ab8d76771c8b773b6891.png) As you can see, this gets some good-looking results BUT they're incorrect! Our query is looking at the occurrence of each individual item within the `links.raw` array, instead of treating the array as a single unit. In order to get the kind of visualization you want, I had to create a scripted field (Management \> Index Patterns \> Scripted Fields). I named it `formattedLinks` and configured it like this: ![](https://us1.discourse-cdn.com/elastic/original/3X/3/7/3717e0d1c7ad02908728f11e84b4a64b39582641.png) This concatenates the values in the array. Then I changed my visualization to aggregate on this scripted field instead of `links.raw`. Now I got a visualization more inline with what you're looking for. The only challenge is if the order of your values isn't deterministic (e.g. you see arrays of both ["foo", "bar"] and ["bar", "foo"], then you will need to sort them, too. If you're doing that then I recommend looking at something like Logstash to format this data at ingest time (instead of at query time), which will be much more efficient and faster. Does this help? CJ ---
**Author:** ![snicoll](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snicoll/32/20285_2.png) [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Post date:** [July 23, 2017, 12:57pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/5 "2017-07-23T12:57:42Z")
Thanks a lot, that answers my question! Cheers ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 20, 2017, 12:57pm UTC](https://discuss.elastic.co/t/top-terms-in-comma-separated-list/93953/6 "2017-08-20T12:57:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.