How to do a stats count by on only some array elements?

[thomas_nguyen]

Hey everyone. I am trying to do a stats count by items{}.description, items{}.price but I'd like to filter out some of the items. In this example, I'd like to include "description one" and "description two", but not "description three".  In the real situation there is many more that I'd like to include and to exclude.

Is this possible?

"time": "01:01:01",
"items": [
    {
      "description": "description one",
      "price": "$220"
    },
    {
      "description": "description two",
      "price": "$10"
    },
    {
      "description": "description three",
      "price": "$50"
    }
]

[ITWhisperer · Accepted solution]

Try extracting the items from the collection with spath, then mvexpand the multi-value field, then extract the next level down, and filter the values you want to keep

| spath items{} output=items
| mvexpand items
| spath input=items
| where description IN ("description one", "description two")
| stats count by description, price

[thomas_nguyen]

@ITWhisperer thank you so much. That worked. I did have to tweak it slightly but I was able to get what I was looking for. 

| spath output=items path=items{}
| mvexpand items
| spath input=items
| where description IN ("description one", "description two")
| stats count by description, price

[ITWhisperer]

Thanks - I updated the solution (a typo on my part) 😀