title: Elasticsearch group-by field
body: <p>I have some squid data like below:</p>
  
  <pre><code>{"requestresultcode": "TCP_MISS/200"},
  {"requestresultcode": "TCP_MISS/200"},
  {"requestresultcode": "TCP_MISS/302"},
  {"requestresultcode": "TCP_MISS/504"},
  {"requestresultcode": "TCP_MISS/200"},
  {"requestresultcode": "ERR_CLIENT_ABORT/000"},
  {"requestresultcode": "ERR_CLIENT_ABORT/200"},
  {"requestresultcode": "ERR_CLIENT_ABORT/302"},
  {"requestresultcode": "ERR_CLIENT_ABORT/502"},
  {"requestresultcode": "ERR_CONNECT_FAIL/502"}
  </code></pre>
  
  <p>I want to group by the field, so I used aggregations terms to do it</p>
  
  <pre><code>{
    "aggs": {
      "agg1": {
        "terms": {
          "field": "cacheresultcode"
        }
      }
    }
  }
  </code></pre>
  
  <p>I got the result:</p>
  
  <pre><code>"aggregations": {
      "agg1": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "200",
            "doc_count": 2011
          },
          {
            "key": "tcp_miss",
            "doc_count": 1740
          },
          {
            "key": "err_client_abort",
            "doc_count": 705
          },
          {
            "key": "302",
            "doc_count": 244
          },
          {
            "key": "000",
            "doc_count": 185
          },
          {
            "key": "502",
            "doc_count": 24
          },
          {
            "key": "err_connect_fail",
            "doc_count": 23
          },
          {
            "key": "504",
            "doc_count": 4
          }
        ]
      }
    }
  </code></pre>
  
  <p>It is a few different between use SQL, I think it should be like</p>
  
  <ul>
  <li>ERR_CLIENT_ABORT/000 </li>
  <li>ERR_CLIENT_ABORT/200 </li>
  <li>ERR_CLIENT_ABORT/302</li>
  <li>ERR_CLIENT_ABORT/502</li>
  <li>ERR_CONNECT_FAIL/502</li>
  <li>TCP_MISS/200</li>
  <li>TCP_MISS/302</li>
  <li>TCP_MISS/504</li>
  </ul>
  
  <p>How should I do ?<br />
  Thanks for your help !!</p>