SELECT    structPayload.sessionId, SUM(failures) failures, SUM(restores) restores
 FROM
(
SELECT
   structPayload.sessionId,
  CASE WHEN structPayload.event = 'failure' THEN 1
   ELSE 0 END as failures,
  CASE WHEN structPayload.event = 'restored' THEN 1
   ELSE 0 END as restores
  FROM [aaa.aaaaa_20160501]
  WHERE metadata.labels.value = 'express'
  ORDER BY metadata.timestamp desc LIMIT 1000
  ) a
  GROUP BY structPayload.sessionId