# Does es can solve below requirement?

**URL:** <https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177>\
**Category:** Elasticsearch\
**Created:** [March 23, 2016, 3:16am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177 "2016-03-23T03:16:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kramer\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kramer_li/32/46872_2.png) [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Post date:** [March 23, 2016, 3:16am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/1 "2016-03-23T03:16:10Z")

</div>

Firstly I know ES can do it functionally. But the performance is not very good. So I want to know if I am doing wrong or ES just can not.

My requirements is like I have some data in below format

```
appID, clientID,clientIP,times

```

1, 2, ,1.1.1.1, 20

I want to know something like  
SELECT clientIP, sum(times) FROM table GROUP BY clientIP order by sum(times)

I want to get the top 3 ip which visit our web most.

ES can do this , but the performance is poor if there is too much unique IP. I use 16G memory, 8 core computer.  
8g memory to ES and no swap. It took 1 minute to return result if there are 10 million data. It is unacceptable.

So ... Am I using a wrong way or ES not fit in this requirement? Should I go for spark?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 23, 2016, 3:20am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/2 "2016-03-23T03:20:22Z")

</div>

> [@Kramer\_Li](#):
>
> Firstly I know ES can do it functionally. But the performance is not very good. So

Is there more to this? 🙂

---

<div class="post-metadata">

**Author:** ![Kramer\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kramer_li/32/46872_2.png) [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Post date:** [March 23, 2016, 3:22am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/3 "2016-03-23T03:22:49Z")

</div>

yes... I clicked the post button by accident. Now it is finished 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 23, 2016, 3:29am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/4 "2016-03-23T03:29:58Z")

</div>

That seems wrong, it should be able to do that _very_ quickly.

What version are you on?

---

<div class="post-metadata">

**Author:** ![Kramer\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kramer_li/32/46872_2.png) [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Post date:** [March 23, 2016, 4:06am UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/5 "2016-03-23T04:06:41Z")

</div>

ES2.2. I am using term aggregation since I want to aggregate on a field. And I use shard\_size 0 to make it accurate

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:06pm UTC](https://discuss.elastic.co/t/does-es-can-solve-below-requirement/45177/6 "2017-07-05T23:06:02Z")

</div>