# Conditional counts on subbuckets
**URL:** https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110
**Category:** Elasticsearch
**Created:** [December 10, 2018, 7:27am UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110 "2018-12-10T07:27:12Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@cabp](https://discuss.elastic.co/u/cabp)
#### Post date: [December 10, 2018, 7:27am UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/1 "2018-12-10T07:27:12Z")
I want to get the counts of nested groups which satisfy a certain condition.
Consider the following:
```
DELETE usagestats
PUT usagestats/test/1
{
"user-id": "abc",
"session-id": "abc-1",
"action": "A123"
}
PUT usagestats/test/2
{
"user-id": "abc",
"session-id": "abc-2",
"action": "A123"
}
PUT usagestats/test/3
{
"user-id": "xyz",
"session-id": "xyz-1",
"action": "A123"
}
PUT usagestats/test/4
{
"user-id": "xyz",
"session-id": "xyz-1",
"action": "A123"
}
PUT usagestats/test/5
{
"user-id": "abc",
"session-id": "abc-2",
"action": "Z789"
}
```
I want to tell tell, how many returning user ( session-ids \>= 2 ) triggered a specific action ( action = "A123" ) on Mon., Thu., Wed...
Therefore I am interessted in the count of a specific "action"s on a timeline if a given "user-id" that has at least 2 distinct "session-id"s.
My approach:
1. create a bucket for each "user-id"
But how do I go on from here??
1. consider only buckets having at least 2 distinct "session-ids" vs. consider only buckets having exactly 1 distinct "session-ids".
2. consider only buckets having a least one document matching (action: "A123")
3. the aggregate count of remaining documents in a time-histogram
Thanks alot!
Tobi
---
### Author:  [@cabp](https://discuss.elastic.co/u/cabp)
#### Post date: [December 12, 2018, 7:42am UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/2 "2018-12-12T07:42:13Z")
The bucket-selector did the trick:
```
GET usagestats/test/_search?
{
"aggs":{
"user":{
"terms":{
"field":"user-id.keyword"
},
"aggs":{
"session":{
"terms":{
"field":"session-id.keyword"
}
},
"session_filter":{
"bucket_selector":{
"buckets_path":{
"sessions":"session._bucket_count"
},
"script":"params.sessions > 1"
}
}
}
}
}
}
```
---
### Author:  [@cabp](https://discuss.elastic.co/u/cabp)
#### Post date: [December 12, 2018, 1:25pm UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/3 "2018-12-12T13:25:06Z")
The selection of the bucket works, but it does not satisfy my use-case.
It returns:
```
"buckets": [
{
"key": "abc-1",
"doc_count": 2
},
{
"key": "abc-2",
"doc_count": 1
}
]
```
But I do not want the aggration as a result (i.e. _"doc\_count": 2_) , but all documents:
```
"buckets": [
{
"session-id": "abc-1",
"action": "A123"
},
{
"session-id": "abc-2",
"action": "Z789"
},
{
"session-id": "abc-2",
"action": "A123"
}
]
```
Can I achive this using multi-aggregations??
---
### Author:  [@abdon](https://discuss.elastic.co/u/abdon)
#### Post date: [December 13, 2018, 5:17pm UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/4 "2018-12-13T17:17:42Z")
Have you considered [the top\_hits aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html)? It can show you the documents in each bucket:
```auto
GET usagestats/test/_search
{
"size": 0,
"aggs": {
"user": {
"terms": {
"field": "user-id.keyword"
},
"aggs": {
"session": {
"terms": {
"field": "session-id.keyword"
},
"aggs": {
"documents": {
"top_hits": {
"size": 10
}
}
}
},
"session_filter": {
"bucket_selector": {
"buckets_path": {
"sessions": "session._bucket_count"
},
"script": "params.sessions > 1"
}
}
}
}
}
}
```
---
### Author:  [@cabp](https://discuss.elastic.co/u/cabp)
#### Post date: [December 17, 2018, 10:25am UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/5 "2018-12-17T10:25:53Z")
> [@abdon](#):
>
> Have you considered [the top\_hits aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-top-hits-aggregation.html)?
Looks promising, indeed! Thank you very much.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 14, 2019, 10:25am UTC](https://discuss.elastic.co/t/conditional-counts-on-subbuckets/160110/6 "2019-01-14T10:25:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.