# Aggregation on \`doc\_count\` of previous Aggregation

**URL:** <https://discuss.elastic.co/t/aggregation-on-doc-count-of-previous-aggregation/71840>\
**Category:** Elasticsearch\
**Created:** [January 17, 2017, 10:22am UTC](https://discuss.elastic.co/t/aggregation-on-doc-count-of-previous-aggregation/71840 "2017-01-17T10:22:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hoalongrbvn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoalongrbvn/32/14644_2.png) [@hoalongrbvn](https://discuss.elastic.co/u/hoalongrbvn)\
**Post date:** [January 17, 2017, 10:22am UTC](https://discuss.elastic.co/t/aggregation-on-doc-count-of-previous-aggregation/71840/1 "2017-01-17T10:22:02Z")

</div>

Hello,

My system log all login action of users to ES, and I want to know how frequency they are login.  
Data structure is simple, each time one user logged in, `userId` and `currentTime` are saved, one document for one login. Eg:

```auto
{ userId: 1, currentTime: "2017-01-01T00:00:00.000Z" },
{ userId: 3, currentTime: "2017-01-01T01:01:15.000Z" },
{ userId: 4, currentTime: "2017-01-01T04:01:18.000Z" },
{ userId: 5, currentTime: "2017-01-01T08:04:25.000Z" },
{ userId: 4, currentTime: "2017-01-02T02:03:47.000Z" },
{ userId: 1, currentTime: "2017-01-02T09:07:12.000Z" },
{ userId: 4, currentTime: "2017-01-03T11:31:12.000Z" }

```

From `2017-01-01` to `2017-01-03`:

- There are 2 users login one time: userId 3 and 5
- There is 1 user login two times: userId 1
- There is 1 user login three times: userId 4
- ...

The final result I want is something like:

```auto
{
  "1": 2, /* 1 time */
  "2_3": 2 /* 2 to 3 times */,
  "4_*": 0 /* More than 4 times */
}

```

I would greatly appreciate if somebody can help. Thank you.

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [January 17, 2017, 10:53am UTC](https://discuss.elastic.co/t/aggregation-on-doc-count-of-previous-aggregation/71840/2 "2017-01-17T10:53:32Z")

</div>

This isn't currently possible in aggregations, we do have an issue open for adding this kind of aggregation to pivot on the results of other aggregations: [https://github.com/elastic/elasticsearch/issues/17590](https://github.com/elastic/elasticsearch/issues/17590)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2017, 10:53am UTC](https://discuss.elastic.co/t/aggregation-on-doc-count-of-previous-aggregation/71840/3 "2017-02-14T10:53:51Z")

</div>

Closed on February 14, 2017, 10:53am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.