# % by breaking subgroup
**URL:** https://discuss.elastic.co/t/by-breaking-subgroup/384865
**Category:** Elasticsearch
**Created:** [February 2, 2026, 7:09pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865 "2026-02-02T19:09:18Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 2, 2026, 7:09pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/1 "2026-02-02T19:09:18Z")
I have following record
```auto
month client minute
1/1/25 A 100
1/1/25 B 100
2/1/25 A 100
2/1/25 B 100
```
I want to setup table vz by month aggregation
```auto
1/1/25 A 100 25%
1/1/25 B 100 25%
2/1/25 A 100 25%
2/1/25 B 100 25%
--------------------
400
```
first column is month aggregation
second column is client
third colum is formula is sum(minutes)
last column is (sum(minutes) / overall\_sum(sum(minutes)))
but when I do this each % shows 100%. what am I doing wrong?
It seems to be doing overall sum for only month for that client rather then full sum of everything
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 2, 2026, 7:55pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/2 "2026-02-02T19:55:42Z")
if I remove the month aggregation (first column) it works. But I want multiple month to select for better visibility.
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 3, 2026, 4:27pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/3 "2026-02-03T16:27:00Z")
hmm after lot of testing I still can’t figure out
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 3, 2026, 5:20pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/4 "2026-02-03T17:20:42Z")
> [@elasticforme](#):
>
> I have following record
Record?
> [@elasticforme](#):
>
> ```auto
> month client minute
> 1/1/25 A 100
> 1/1/25 B 100
> 2/1/25 A 100
> 2/1/25 B 100
>
> ```
Is this one document? More than one, 4 maybe? Result from some aggregation?
Most "how do I achieve this" questions are actually "how do I achieve this with a given set of data". It helps significantly if you also share the actual data (or a representative sample)!
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [February 3, 2026, 5:22pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/5 "2026-02-03T17:22:56Z")
Hello @elasticforme
I need to try but maybe we should create a keyword field from date field so that the date histogram bucket is not applied month wise for the total %
Thanks!!
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 3, 2026, 5:40pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/6 "2026-02-03T17:40:59Z")
@RainTown yes this is four difference document. I just put this for simple representation.
@Tortoise you are right if I remove month (date) histogram aggregation it works. but when I have this month aggregation it does not works.
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [February 4, 2026, 6:21am UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/7 "2026-02-04T06:21:06Z")
Hello @elasticforme
Yes, if we create a date\_k keyword field which is derived from date field than it is possible :
```auto
Created a runtime field date_keyword :
if (doc['month'].size() > 0) {
emit(doc['month'].value.toString().substring(0,7));
}
```
```auto
Data Set used :
PUT minutes_data/_doc/1
{
"month": "2025-01-02",
"client": "A",
"minute": 200
}
PUT minutes_data/_doc/2
{
"month": "2025-01-01",
"client": "B",
"minute": 100
}
PUT minutes_data/_doc/3
{
"month": "2025-02-01",
"client": "A",
"minute": 100
}
PUT minutes_data/_doc/4
{
"month": "2025-02-01",
"client": "B",
"minute": 100
}
PUT minutes_data/_doc/5
{
"month": "2025-01-01",
"client": "A",
"minute": 100
}
```
Thanks!!
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [February 4, 2026, 12:01pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/8 "2026-02-04T12:01:00Z")
cool, nice workaround.
I guess overall\_sum only works "overall" in sense of parent terms aggregations, but not date\_histogram aggregations ? Is that documented somewhere cos I agree it's not obvious.
I used your docs and this mapping:
```auto
PUT /minutes_data/_mapping
{
"runtime": {
"date_keyword": {
"type": "keyword",
"script": {
"source": "emit(doc['month'].value.toString().substring(0,7))"
}
}
},
"properties": {
"client": {
"type": "keyword",
"ignore_above": 256
},
"minute": {
"type": "long"
},
"month": {
"type": "date",
"format": "yyyy-MM-dd"
}
}
}
```
and generated the required viz:
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [February 4, 2026, 6:12pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865/9 "2026-02-04T18:12:52Z")
Thank you for giving me insight on how to do this.