# Aggregation across multiple indices **URL:** \ **Category:** Elasticsearch\ **Created:** [April 27, 2021, 9:49am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350 "2021-04-27T09:49:16Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [April 27, 2021, 9:49am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/1 "2021-04-27T09:49:17Z")
I have 2 indices and they store data of the same mappings on different dates - t1 and t2. I have a multi term aggregation below which works on a single index. How can I get elasticsearch to return the same aggregation across t1 and t2 as well as do some comparison like t1.total-price - t2.total-price? ```auto PUT t1/_mappings/ { "properties": { "account": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "price": { "type": "double", "null_value": 0 } } GET /t1/_search { "size": 0, "aggs": { "group-by-account": { "terms": { "field": "account.keyword" }, "aggs": { "total-price": { "sum": { "field": "price" } } } } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 28, 2021, 1:32am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/2 "2021-04-28T01:32:53Z")
You can use `GET t1,t2/_search` or even `GET t*/_search` to search across multiple indices. See [Search multiple data streams and indices | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch//reference/current/search-multiple-indices.html) ---
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [April 28, 2021, 10:34am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/3 "2021-04-28T10:34:12Z")
Yes I got that. I am able to get t1 and t2 returned together but I am not sure how I can calculate the difference between aggregated results across the 2 indices. Any ideas on that? ---
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [April 28, 2021, 11:07am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/4 "2021-04-28T11:07:20Z")
```auto GET /t1,t2/_search { "size": 0, "aggs": { "byindex": { "terms": { "field": "_index", "size": 2 }, "aggs": { "group-by-account": { "terms": { "field": "account.keyword" }, "aggs": { "total-price": { "sum": { "field": "price" } } } } } } } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 28, 2021, 11:35pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/5 "2021-04-28T23:35:58Z")
> [@ice2021](#): > > how I can calculate the difference between aggregated results across the 2 indices Can you elaborate more on the differences you want to aggregate between? ---
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [April 29, 2021, 10:39am UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/6 "2021-04-29T10:39:21Z")
I am trying to create the data in the following fashion. index: t1 |Account|Price| |a|100| |b|200| |c|300| index: t2 |Account|Price| |a|200| |b|400| |c|600| results of t2 -t1 |Account|Price| |a|100| |b|200| |c|300| Below is the response I get currently. However, I am trying to get the difference between sum(price) across t1 and t2 group by the account ```auto "aggregations" : { "byindex" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "t1", "doc_count" : 135212, "group-by-account" : { "doc_count_error_upper_bound" : 1123, "sum_other_doc_count" : 56391, "buckets" : [ { "key" : "a", "doc_count" : 13145, "mtm" : { "price" : 5.343518269844282E7 } }, { "key" : "t2", "doc_count" : 135212, "group-by-account" : { "doc_count_error_upper_bound" : 1123, "sum_other_doc_count" : 56391, "buckets" : [ { "key" : "a", "doc_count" : 13145, "mtm" : { "value" : 5.343518269844285E7 } }, ``` ---
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [May 5, 2021, 10:21pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/7 "2021-05-05T22:21:21Z")
Could someone please advise here? ---
**Author:** ![vincenbr](https://avatars.discourse-cdn.com/v4/letter/v/8edcca/32.png) [@vincenbr](https://discuss.elastic.co/u/vincenbr)\ **Post date:** [May 6, 2021, 9:43pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/8 "2021-05-06T21:43:54Z")
Hi ice2021, it is perfectly doable with a [Bucket script aggregation | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html) The tricky part is the bucket path: follow the link in the mentioned doc to "bucket path syntax". Tip: the account should be your top aggregation. Then, for each account you can aggregate by index, and get the sum of prices. your final bucket-script-aggregation will just substract the 2 sums, using bucket paths which contain the index names (that you should know). ---
**Author:** ![ice2021](https://avatars.discourse-cdn.com/v4/letter/i/c68b51/32.png) [@ice2021](https://discuss.elastic.co/u/ice2021)\ **Post date:** [May 20, 2021, 3:07pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/9 "2021-05-20T15:07:36Z")
Got it working. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 17, 2021, 3:07pm UTC](https://discuss.elastic.co/t/aggregation-across-multiple-indices/271350/10 "2021-06-17T15:07:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.