Solution to my problem was as suggested to use terms instead of term.
Posted full request below as I could not find so might be beneficial to others who are searching for same answer.
{
"query": {
"bool": {
"must": [
{
"term": {
"syslog.log_key": "time"
}
}
],
"must_not": [],
"should": []
}
},
"size": 0,
"facets": {
"tag": {
"terms_stats": {
"key_field": "function",
"value_field": "log_value"
},
"facet_filter": {
"terms": {
"function": [
"query_parser",
"term_highlighter"
]
}
}
}
}
}