# Group docs with same internal ID and then aggregate in to buckets by number of matches

**URL:** <https://discuss.elastic.co/t/group-docs-with-same-internal-id-and-then-aggregate-in-to-buckets-by-number-of-matches/188476>\
**Category:** Elasticsearch\
**Created:** [July 2, 2019, 10:25am UTC](https://discuss.elastic.co/t/group-docs-with-same-internal-id-and-then-aggregate-in-to-buckets-by-number-of-matches/188476 "2019-07-02T10:25:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![spk3r](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spk3r/32/49259_2.png) [@spk3r](https://discuss.elastic.co/u/spk3r)\
**Post date:** [July 2, 2019, 10:25am UTC](https://discuss.elastic.co/t/group-docs-with-same-internal-id-and-then-aggregate-in-to-buckets-by-number-of-matches/188476/1 "2019-07-02T10:25:35Z")

</div>

I have index called "events", where each doc is different event. Events are generated by devices, which have internal ID's.

I want to group events by "deviceId", and then aggregate them by number of events they generated. Buckets may be "0-10", if particular device generated from 0 to 10 events (docs), and "10-100", "100-1000", "1000+" respectively.

It seems, I need "Pipeline Aggregations", but since I'm completely new to elastic, it's look little bit too tricky, and I can't find right query for this. Already tried a lot of different combinations with different level of nesting.

In the result, I wan't to count how many devices are presented in each group of this range buckets. DeviceId's also need to be available inside buckets, if I will want to get device list, or particular device details (both will be new queries and unrelated with this one).

Here is example code which for sure is not working:

```
GET events/_search { "size": 0, "aggs": {
"perMonth": {
"date_histogram": {
"field": "timestamp",
"interval": "1M",
"min_doc_count": 0
},
"aggs": {
"byDevice": {
  "terms": {
    "field": "deviceId"
  }
},
"0-10": {
  "bucket_script": {
    "buckets_path": {
      "count": "byDevice>_count"
    },
    "script": "params.count <= 10"
  }
},
"10-100": {
  "bucket_script": {
    "buckets_path": {
      "count": "byDevice>_count"
    },
    "script": "params.count > 10 && params.count >= 100"
  }
},
"100-1000": {
  "bucket_script": {
    "buckets_path": {
      "count": "byDevice>_count"
    },
    "script": "params.count > 100 && params.count >= 1000"
  }
},
"1000+": {
  "bucket_script": {
    "buckets_path": {
      "count": "byDevice>_count"
    },
    "script": "params.count > 1000"
  }
}
}
}
}
}

```

As a result I wan't to get:

```
{ "0-10": { doc_count: n, docs: [...]}, "10-100": { doc_count: n, docs: [...]}, "100-1000": { doc_count: n, docs: [...]}, "1000+": { doc_count: n, docs: [...]} }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2019, 10:25am UTC](https://discuss.elastic.co/t/group-docs-with-same-internal-id-and-then-aggregate-in-to-buckets-by-number-of-matches/188476/2 "2019-07-30T10:25:41Z")

</div>

Closed on July 30, 2019, 10:25am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.