# Combine documents for aggregate query
**URL:** https://discuss.elastic.co/t/combine-documents-for-aggregate-query/19084
**Category:** Elasticsearch
**Created:** [August 5, 2014, 2:39am UTC](https://discuss.elastic.co/t/combine-documents-for-aggregate-query/19084 "2014-08-05T02:39:06Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Martin\_Takeuchi](https://discuss.elastic.co/u/Martin_Takeuchi)
#### Post date: [August 5, 2014, 2:39am UTC](https://discuss.elastic.co/t/combine-documents-for-aggregate-query/19084/1 "2014-08-05T02:39:06Z")
Hi,
I'm new to elasticsearch, so please bear with me.
I am using logstash to ship sendmail logs into elasticsearch.
For any particular mail, sendmail logs the "to" address and "from"
addresses in different log entries,
resulting in (at least) two different elasticsearch documents per mail
(they do share a sendmail message ID).
for example:
{
id: 1
msgid: s938943sa99
from: [joe@example.com](mailto:joe@example.com)
relayip: 192.168.0.1
}
{
id: 2
msgid: s938943sa99
to: [frank@example.com](mailto:frank@example.com)
status: Sent
}
I would like to be able to find out the number of mails sent per to/from
combination over a particular time period,
i.e. 5 mails sent from [joe@example.com](mailto:joe@example.com) to [frank@example.com](mailto:frank@example.com), and 7 mails
sent from [mary@example.com](mailto:mary@example.com) to [sara@example.com](mailto:sara@example.com) in the last hour.
I understand about using aggregations on a field, so I can find out how
many mails were sent from a particular address:
curl -XGET '[http://localhost:9200/logstash\*/\_search?pretty=true](http://localhost:9200/logstash*/_search?pretty=true)' -d '
{
"query" : {
"bool" : {
"must" : [
{
"range" : {
"@timestamp" : {
"gt" : "now-1h"
}
}
}
]
}
},
"aggs" : {
"myfrom" : {
"terms" : {
"field" : "from.raw",
"min\_doc\_count" : 1
}
}
}
}'
I don't see how I can combine the documents to aggregate on to/from
combination.
Is this possible?
Thanks for any help,
Martin
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b8d758b5-dd4e-4218-8f89-00970b4519a3%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b8d758b5-dd4e-4218-8f89-00970b4519a3%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:10am UTC](https://discuss.elastic.co/t/combine-documents-for-aggregate-query/19084/2 "2017-07-06T01:10:50Z")