# How to aggregate buckets from top\_hits?

**URL:** https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484
**Category:** Elasticsearch
**Created:** [October 26, 2017, 9:49pm UTC](https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484 "2017-10-26T21:49:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![stoth](https://avatars.discourse-cdn.com/v4/letter/s/a698b9/32.png) [@stoth](https://discuss.elastic.co/u/stoth)
#### Post date: [October 26, 2017, 9:49pm UTC](https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484/1 "2017-10-26T21:49:23Z")

</div>

I have a document per app instance per cloud. For example:

**cloud: 1, appInstanceId: 123, timeReceived: 1509371566235291000 (timestamp stored as long), numWidgets: 99**  
cloud: 1, appInstanceId: 802, timeReceived: 1509371566235291000, numWidgets: 45  
**cloud: 1, appInstanceId: 123, timeReceived: 1509371571672334000, numWidgets: 102**  
cloud: 2, appInstanceId: 267, timeReceived: 1509371566235291000, numWidgets: 88  
cloud: 2, appInstanceId: 529, timeReceived: 1509371566235291000, numWidgets: 23

appInstanceId uniquely identifies an App Instance (not re-used across clouds). New documents are sent every X secs. I'm trying to get the current total Widgets per Cloud (bold records above are for same App Instance, want the latest for the App Instance). To accomplish this I'm trying the following:

Term agg by cloud (to group by Cloud) named "cloud"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Term subagg (to group by App Instance) named "app\_instance"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Top Hits subagg (to get the latest document per App Instance based on the time received desc) named "latest\_hit"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sum Bucket pipeline agg (sibling to the App Instance Top Hits aggs to sum the latest App Instance docs for the Cloud) named "cloud\_widgets"

I cannot figure out (if it's even possible) how to path it to get the numWidgets. I get an error that the path is not supported -\> "path not supported for [latest\_hit]: [numWidgets]".

I'm new to Elasticsearch and may be taking the wrong approach. Query and output (without the sum\_bucket since it doesn't work) are below. Any assistance would be appreciated.

Query...

```
           {
        "size": 0,
        "_source" : ["appInstanceId", "cloud", "instance", "timeReceived", "numWidgets"],
        "aggs": {
            "cloud": {
                "terms": {
                    "field": "cloud",
                    "size": 10000
                },
                "aggs": {
                    "app_instance" : {
                        "terms": {
                            "field": "appInstanceId",
                            "size": 10000
                        },
                        "aggs": {
                            "latest_hit": {
                                "top_hits": {
                                    "_source" : {
                                        "includes": ["numWidgets"]
                                    },
                                    "sort": [{
                                        "timeReceived": {
                                            "order": "desc"
                                        }
                                    }],                   
                                    "size": 1
                                }
                            }                        
                        }
                    },
                    "cloud_widgets": {
                        "sum_bucket": {
                            "buckets_path" : "app_instance>latest_hit.numWidgets"
                        }
                    }                
                }
            }
        }
    }

```

Output...

```
 {
  "took": 4866,
  "hits": {
    "total": 31049103,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "cloud": {
      "buckets": [
        {
          "key": 1,
          "doc_count": 1295244,
          "app_instance": {
            "buckets": [
              {
                "key": 123,
                "doc_count": 53976,
                "latest_hit": {
                  "hits": {
                    "total": 53976,
                    "max_score": null,
                    "hits": [
                      {
                        "_index": "my-index-2017.10.23",
                        "_type": "doc",
                        "_id": "AV9LrmOT4sZ0l4JseyWZ",
                        "_score": null,
                        "_source": {
                          "numWidgets": 102
                        }
                      }
                    ]
                  }
                }
              },
              {
                "key": 802,
                "doc_count": 53975,
                "latest_hit": {
                  "hits": {
                    "total": 53975,
                    "max_score": null,
                    "hits": [
                      {
                        "_index": "my-index-2017.10.23",
                        "_type": "doc",
                        "_id": "AV9LrmRw4sZ0l4JseyYE",
                        "_score": null,
                        "_source": {
                          "numWidgets": 45
                        }
                      }
                    ]
                  }
                }
              }
            ]
        },
        {
          "key": 2,
          "doc_count": 1295211,
          "app_instance": {
            "buckets": [
              {
                "key": 267,
                "doc_count": 53979,
                "latest_hit": {
                  "hits": {
                    "total": 53979,
                    "max_score": null,
                    "hits": [
                      {
                        "_index": "my-index-2017.10.23",
                        "_type": "doc",
                        "_id": "AV9LrmOT4sZ0l4JseyWd",
                        "_score": null,
                        "_source": {
                          "numWidgets": 88
                        }
                      }
                    ]
                  }
                }
              },
              {
                "key": 529,
                "doc_count": 53978,
                "latest_hit": {
                  "hits": {
                    "total": 53978,
                    "max_score": null,
                    "hits": [
                      {
                        "_index": "my-index-2017.10.23",
                        "_type": "doc",
                        "_id": "AV9LrmRw4sZ0l4JseyXq",
                        "_score": null,
                        "_source": {
                          "numWidgets": 23
                        }
                      }
                    ]
                  }
                }
              }
            ]
          }
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2017, 9:49pm UTC](https://discuss.elastic.co/t/how-to-aggregate-buckets-from-top-hits/105484/2 "2017-11-23T21:49:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.