# Elastic aggregation query question

**URL:** <https://discuss.elastic.co/t/elastic-aggregation-query-question/90196>\
**Category:** Elasticsearch\
**Created:** [June 21, 2017, 5:28am UTC](https://discuss.elastic.co/t/elastic-aggregation-query-question/90196 "2017-06-21T05:28:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xwang12345](https://avatars.discourse-cdn.com/v4/letter/x/49beb7/32.png) [@xwang12345](https://discuss.elastic.co/u/xwang12345)\
**Post date:** [June 21, 2017, 5:28am UTC](https://discuss.elastic.co/t/elastic-aggregation-query-question/90196/1 "2017-06-21T05:28:33Z")

</div>

If I have many network session status documents, which I would like to aggregate on a the five tuples (src\_ip, src\_port, dst\_ip, dst\_port, proto), how do I write the aggregation query?

Do I write a aggregations with 5 levels? Could someone point me to an similar example?

---

<div class="post-metadata">

**Author:** ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)\
**Post date:** [June 23, 2017, 2:40pm UTC](https://discuss.elastic.co/t/elastic-aggregation-query-question/90196/2 "2017-06-23T14:40:25Z")

</div>

Potentially, yes. The usual procedure is to continue embedding aggregations inside each other to get each "layer" of the tuple. E.g. in this case, you'd probably use a bunch of `terms` aggregations.

Or you could use a single terms agg with a `script` field to combine all the values into a single string.

It sorta depends on what you want as the end result. Embedded aggs will give doc-counts at each level, as well as any metrics you specify. A single agg with concatenated tuple using `script` will give you one layer and only doc counts for that specific tuple. It'll also incur the overhead of executing the script, although with Painless it should be pretty small.

Do be careful with a high-cardinality tuples like that though (regardless of the approach you take), since the memory overhead of so many buckets could be expensive. You may want to use the `partitions` feature of the terms agg to "paginate" through the terms, so they don't all come back at once.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2017, 2:40pm UTC](https://discuss.elastic.co/t/elastic-aggregation-query-question/90196/3 "2017-07-21T14:40:30Z")

</div>

Closed on July 21, 2017, 2:40pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.