# Aggregations of aggregations

**URL:** <https://discuss.elastic.co/t/aggregations-of-aggregations/153071>\
**Category:** Elasticsearch\
**Created:** [October 18, 2018, 9:07pm UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071 "2018-10-18T21:07:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stepane](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@Stepane](https://discuss.elastic.co/u/Stepane)\
**Post date:** [October 18, 2018, 9:08pm UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/1 "2018-10-18T21:08:00Z")

</div>

Hi,

I save all the connections of the different internal applications in an elasticsearch index.

I have, for example, these recordings:

```
{
    "host": "www.internal-app-1.com",
    "login": "user1",
    "time": "2018-10-01 10:02:02"
},
{
    "host": "www.internal-app-1.com",
    "login": "user2",
    "time": "2018-10-01 12:02:02"
},
{
    "host": "www.internal-app-2.com",
    "login": "user1",
    "time": "2018-10-01 14:02:02"
},

```

I am looking to count the number of users who have logged into X apps.

I would have in return :

1 user has logged in to 2 apps  
2 users has logged in to 1 apps

How to calculate this aggregates?

Thank you

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [October 18, 2018, 9:37pm UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/2 "2018-10-18T21:37:27Z")

</div>

I think you want the [sum bucket aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-sum-bucket-aggregation.html). The actual summing is done on the coordinating node so the whole process isn't quite as parallel is it would be in a perfect world, but it'll get the job done.

---

<div class="post-metadata">

**Author:** ![Stepane](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@Stepane](https://discuss.elastic.co/u/Stepane)\
**Post date:** [October 18, 2018, 9:43pm UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/3 "2018-10-18T21:43:56Z")

</div>

Hi nik9000,

Thank you for your help, I will look at this aggregates. If you have an example to provide me with my dataset, it will help me a lot. Thank you

---

<div class="post-metadata">

**Author:** ![Stepane](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@Stepane](https://discuss.elastic.co/u/Stepane)\
**Post date:** [October 19, 2018, 10:00am UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/4 "2018-10-19T10:00:00Z")

</div>

Unfortunately this aggregates do not answer my need.  
I am looking to count the unique number of users who have connected to an X services.

Here is a more complete game and the expected result :

```
{
    "host": "www.internal-app-1.com",
    "login": "user1",
    "time": "2018-10-01 10:02:02"
},
{
    "host": "www.internal-app-1.com",
    "login": "user2",
    "time": "2018-10-01 12:02:02"
},
{
    "host": "www.internal-app-2.com",
    "login": "user1",
    "time": "2018-10-01 14:02:02"
},
{
    "host": "www.internal-app-2.com",
    "login": "user3",
    "time": "2018-10-01 14:02:02"
},
{
    "host": "www.internal-app-3.com",
    "login": "user1",
    "time": "2018-10-01 13:02:02"
},
{
    "host": "www.internal-app-1.com",
    "login": "user1",
    "time": "2018-10-01 17:02:02"
},

```

1 user has logged in to 3 apps  
2 users has logged in to 1 apps

---

<div class="post-metadata">

**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\
**Post date:** [October 19, 2018, 6:16pm UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/5 "2018-10-19T18:16:55Z")

</div>

It feels like you could make a `terms` aggregation and then a sum of the doc\_count with the `sum_bucket` aggregation.

---

<div class="post-metadata">

**Author:** ![klahnakoski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/klahnakoski/32/3679_2.png) [@klahnakoski](https://discuss.elastic.co/u/klahnakoski)\
**Post date:** [October 20, 2018, 11:16am UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/6 "2018-10-20T11:16:25Z")

</div>

You may try terms aggregation on `login` with a `cardinality` aggregate on `host`. This will give you a list of every user and the number of unique apps they have logged into. From there you can either aggregate this locally, or figure out how to use a pipeline aggregate on it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2018, 11:18am UTC](https://discuss.elastic.co/t/aggregations-of-aggregations/153071/7 "2018-11-17T11:18:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.