# Count and group by the results of top\_hits aggregation
**URL:** https://discuss.elastic.co/t/count-and-group-by-the-results-of-top-hits-aggregation/115961
**Category:** Elasticsearch
**Created:** [January 18, 2018, 12:25am UTC](https://discuss.elastic.co/t/count-and-group-by-the-results-of-top-hits-aggregation/115961 "2018-01-18T00:25:03Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)
#### Post date: [January 18, 2018, 12:25am UTC](https://discuss.elastic.co/t/count-and-group-by-the-results-of-top-hits-aggregation/115961/1 "2018-01-18T00:25:03Z")
Hello,
I have logs with the fields:
. IP
. Timestamp
. URI
. SessionId
Each log shows the time (timestamp) the URI was visited. The SessionId is a field I created by concatenating IP with Timestamp (without the minutes or seconds). That is, all the logs belonging to the same day and hour are grouped into the same SessionId.
For e.g.
IP Timestamp URI SessionId
1.2.3.4 December25th2017T08:30:00 [google.com](http://google.com) 1.2.3.4\_25-12-2017\_8
1.2.3.4 December25th2017T08:45:00 [youtube.com](http://youtube.com) 1.2.3.4\_25-12-2017\_8
1.2.3.4 December25th2017T09:30:00 [facebook.com](http://facebook.com) 1.2.3.4\_25-12-2017\_9
1.2.3.4 December25th2017T09:58:00 [youtube.com](http://youtube.com) 1.2.3.4\_25-12-2017\_9
4.3.2.1 December30th2017T15:20:00 [yahoo.com](http://yahoo.com) 4.3.2.1\_30-12-2017\_15
4.3.2.1 December30th2017T15:30:00 [elastic.com](http://elastic.com) 4.3.2.1\_30-12-2017\_15
4.3.2.1 December30th2017T15:58:00 [youtube.com](http://youtube.com) 4.3.2.1\_30-12-2017\_15
5.5.5.5 December30th2017T09.35:00 [bing.com](http://bing.com) 5.5.5.5\_30-12-2017\_9
5.5.5.5 December30th2017T09.59:00 [google.com](http://google.com) 5.5.5.5\_30-12-2017\_9
Now, I need to know the top URI that were the last ones to be visited in the sessions.
That is, for the example above:
-\> "[youtube.com](http://youtube.com)" was the last URI visited in the following sessions:
. 1.2.3.4\_25-12-2017\_8
. 1.2.3.4\_25-12-2017\_9
. 4.3.2.1\_30-12-2017\_15
-\> "[google.com](http://google.com)" was the last URI visited in the following session:
5.5.5.5\_30-12-2017\_9
Therefore, I need a visualization/query that indicates something like:
URI Count
[youtube.com](http://youtube.com) 3
[google.com](http://google.com) 1
So far, I've managed to get the last visited URL's for each session by doing a terms aggregation on session\_id and then a top\_hits aggregation on timestamp.
The problem is that I can't group them by URL (to compute the count for each URL) because top\_hits aggregation doesn't allow any subaggregations...
How can I solve this?
Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2018, 12:25am UTC](https://discuss.elastic.co/t/count-and-group-by-the-results-of-top-hits-aggregation/115961/2 "2018-02-15T00:25:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.