# Elastic Search Query Merging multiple documents

**URL:** <https://discuss.elastic.co/t/elastic-search-query-merging-multiple-documents/183373>\
**Category:** Elasticsearch\
**Created:** [May 29, 2019, 3:35pm UTC](https://discuss.elastic.co/t/elastic-search-query-merging-multiple-documents/183373 "2019-05-29T15:35:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [May 29, 2019, 3:35pm UTC](https://discuss.elastic.co/t/elastic-search-query-merging-multiple-documents/183373/1 "2019-05-29T15:35:38Z")

</div>

I am trying to merge multiple documents together if they contain the same src IP Address within the last 10 minutes.

The situation is zscaler sends us multiple document ( per request ) for each blocked botnet request

I have so far 2 seperate queries : last 5 minutes and top hit for SRC field. Am i on the right track and how do i combine it .

```
GET zscaler-*/_search
{
  "size": 0,  
  "aggs": {
    "by_id": {
      "terms": {
        "field": "src",
        "min_doc_count": 2
      },
      "aggs": {
        "same_ids": {
          "top_hits": {
            "size": 100
          }
        }
      }
    }
  }
}

GET zscaler-*/_search
{
      "query": {
      "range" : {
            "msgSubmissionTime" : {
                "gte" : "now-5m",
                "lt" : "now"
            }
        }
        
      }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 3:35pm UTC](https://discuss.elastic.co/t/elastic-search-query-merging-multiple-documents/183373/2 "2019-06-26T15:35:39Z")

</div>

Closed on June 26, 2019, 3:35pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.