# Aggregate over date\_histogram aggregation to obtain avg, min and max
**URL:** https://discuss.elastic.co/t/aggregate-over-date-histogram-aggregation-to-obtain-avg-min-and-max/153306
**Category:** Elasticsearch
**Created:** [October 21, 2018, 10:11pm UTC](https://discuss.elastic.co/t/aggregate-over-date-histogram-aggregation-to-obtain-avg-min-and-max/153306 "2018-10-21T22:11:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@enkil2003](https://discuss.elastic.co/u/enkil2003)
#### Post date: [October 21, 2018, 10:11pm UTC](https://discuss.elastic.co/t/aggregate-over-date-histogram-aggregation-to-obtain-avg-min-and-max/153306/1 "2018-10-21T22:11:25Z")
I have been cracking my head open for a couple of days trying to translate this splunk query to ElasticSearch, which seems simple by the way.
This is what my splunk query does, which looks simple enough, notice the "by" in the first stats and the second stats.
```
| bucket _time span=1s | stats count by _time brand operation
| stats avg(count), min(count), max(count) by brand operation
```
Basically I need to obtain the avg, min and max per second per brand, per operation.
So far my aggregations just does the first part of the query " | bucket \_time span=1s | stats count by \_time brand operation", But I dont know how to aggregate on that aggregation.
Hope someone can in-light me!
```
{
"aggs": {
"tps": {
"date_histogram": {
"field": "@timestamp",
"interval": "1s"
}
},
"marca": {
"terms": {
"field": "brand",
"size": 100
},
"aggs": {
"operation": {
"filters": {
"other_bucket_key": "secondBrand",
"filters": {
"firstBrand": {
"exists": {
"field": "firstBrand"
}
}
}
}
}
}
}
}
}
```
---
### Author:  [@polyfractal](https://discuss.elastic.co/u/polyfractal)
#### Post date: [October 29, 2018, 11:08am UTC](https://discuss.elastic.co/t/aggregate-over-date-histogram-aggregation-to-obtain-avg-min-and-max/153306/2 "2018-10-29T11:08:38Z")
Hmm, I may be missing something (don't know splunk queries well), and am a bit confused by the second filters agg + exists filter.
If you just need avg/min/max per second, per brand, per operation, you can nest those aggs together like:
```auto
date_histogram: timestamp
terms: brand
terms: operation
avg/min/max
```
by nesting them, you'll get an avg/min/max per operation, which will generate one operation per brand bucket, which generates one brand bucket per timestamp interval.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 26, 2018, 11:08am UTC](https://discuss.elastic.co/t/aggregate-over-date-histogram-aggregation-to-obtain-avg-min-and-max/153306/3 "2018-11-26T11:08:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.