Execute aggs query for each unqiue value?

[Sjaak01 (Sjaak)]

Hi,

I have the following script which gives me the 10 most used applications. I want to expand this by getting the top 10 applications for each unique value in the customers field. Is this possible?

The goal is to apply a set document id such as "customerid-yyyy-mm-dd" and make a lightweight index where all the data is "precalculated" every couple of hours instead of doing a full search every time for users that only need some static data.

{
  "aggs": {
    "2": {
      "terms": {
        "field": "application",
        "order": {
          "1": "desc"
        },
        "size": 10
      },
      "aggs": {
        "1": {
          "sum": {
            "script": {
              "source": "doc['in_bytes'].value + doc['out_bytes'].value",
              "lang": "painless"
            }
          }
        }
      }
    }
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
        "range": {
          "@timestamp": {
            "gte": "now-24h"
            }
          }
        }
      ]
    }
  }
}