# Custom Bucket Sub Aggregations & Top Hits

**URL:** <https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241>\
**Category:** Kibana\
**Created:** [May 10, 2018, 3:26am UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241 "2018-05-10T03:26:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![csepulv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csepulv/32/31038_2.png) [@csepulv](https://discuss.elastic.co/u/csepulv)\
**Post date:** [May 10, 2018, 3:26am UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/1 "2018-05-10T03:26:13Z")

</div>

I would like to a custom aggregation that either doesn't use geohash'ing or uses geohash as a sub-aggregation.

Imagine you are mapping schools or fast food restaurants. I'd like to aggregate by the school type (elementary, middle school, etc.) or restaurant chain name first, then map the metric of count, average, etc. In this case geohash, as a sub aggregation, is fine. (Basically, I have some term/identifier I'd like to use as first level aggregation.)

But I would also like to show the first or last school/restaurant opening, in which case I'd like a top\_hits sub-aggregation and not use the geohash (or, in some cases use top\_hits with the geohash).

Is there any way to do this? Should I open a feature request issue on GitHub?

Thanks

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [May 10, 2018, 6:05pm UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/2 "2018-05-10T18:05:44Z")

</div>

It sounds like what you want is a Geohash filter, not a geohash as part of the aggregation. Basically, you can do what you've already said, aggregate by type and sort by the opening date/time. This will effectively run the aggregation against _all_ of your data, but if you apply a geohash filter, it'll only include documents that are located within that geohash.

---

<div class="post-metadata">

**Author:** ![csepulv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csepulv/32/31038_2.png) [@csepulv](https://discuss.elastic.co/u/csepulv)\
**Post date:** [May 11, 2018, 12:02am UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/3 "2018-05-11T00:02:48Z")

</div>

Sometimes geohasing is okay. But I need nested aggregations. If I have a `position` geopoint field, the resulting aggregation, generated by Kibana would be:

```auto
"aggs": {
              "2": {
                "geohash_grid": {
                  "field": "position",
                  "precision": 3
                },
                "aggs": {
                  "3": {
                    "geo_centroid": {
                      "field": "position"
                    }
                  }
                }
              }
            }

```

But assume I want a breakdown by brand (as in my earlier noted example), I would like the following aggregation/buckets:

```auto
"aggs": {
          "brand": {
            "terms": {
              "field": "brand_name"
            },
            "aggs": {
              "2": {
                "geohash_grid": {
                  "field": "position",
                  "precision": 3
                },
                "aggs": {
                  "3": {
                    "geo_centroid": {
                      "field": "position"
                    }
                  }
                }
              }
            }
          }
        }

```

I don't know anyway to specify such an aggregation and I am pretty sure the map visualization code that generates the leaflet layers wouldn't know what to do with it.

But I am wondering/hoping for an option or maybe guidance on doing this. I am happy to make a issue request is that is appropriate.

Thanks

---

<div class="post-metadata">

**Author:** ![Joe\_Fleming](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_fleming/32/3561_2.png) [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)\
**Post date:** [May 14, 2018, 4:56pm UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/4 "2018-05-14T16:56:22Z")

</div>

Yeah, making an issue in the [Kibana repo](https://github.com/elastic/kibana/issues) might be a good start. I'm not super familiar with the geo functionality in Kibana if I'm being honest, it's changed a lot since I was last in there. Plus, the layer system I mentioned [here](https://discuss.elastic.co/t/embedding-map-visualizations/131243) is going probably going to invalidate the little I do still know. What you're looking for might not be possible now, but may be possible once the layers are available.

---

<div class="post-metadata">

**Author:** ![csepulv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csepulv/32/31038_2.png) [@csepulv](https://discuss.elastic.co/u/csepulv)\
**Post date:** [May 15, 2018, 10:08pm UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/5 "2018-05-15T22:08:44Z")

</div>

I've created a [GitHub issue](https://github.com/elastic/kibana/issues/19096)

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2018, 10:08pm UTC](https://discuss.elastic.co/t/custom-bucket-sub-aggregations-top-hits/131241/6 "2018-06-12T22:08:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.