# How to aggregate when two fields equal each other

**URL:** <https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041>\
**Category:** Elasticsearch\
**Created:** [December 9, 2019, 3:03am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041 "2019-12-09T03:03:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ronin](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@Ronin](https://discuss.elastic.co/u/Ronin)\
**Post date:** [December 9, 2019, 3:03am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041/1 "2019-12-09T03:03:25Z")

</div>

I may be going about this all wrong, but I have the following document structure:

```auto
{
  "@timestamp: "the time",
  "source.ip": "100.100.1.1",
  "destination.ip": "10.10.1.1",
  "bytes_transferred": 5000
}

```

And I am trying to get the sum of all bytes by ip when either the `source.ip` or `destination.ip` are equal to that ip and get that into a table in kibana. So the table for example would be:

```auto
ip | bytes
10.10.1.1 | 7500 (sum of when it is the source ip plus the sum when it is the destination ip)
10.10.1.2 | 5600
10.10.1.3 | 1200

```

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [December 9, 2019, 9:22am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041/2 "2019-12-09T09:22:36Z")

</div>

You need what I would call a "role-free" field. Field names like `source.ip` and `destination.ip` are classic examples of where an entity is mentioned in a document along with the role they play i.e. sender vs recipient. For some analysis you don't care about the role and just want to summarise all of an entity's activities.  
You can do this using a [copy\_to](https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html) statement in your field mappings - create a role-neutral field called something like `ip_addresses` and use a copy\_to command in your `source.ip` and `destination.ip` to include a copy of these values in the `ip_addresses` field. Then do your Kibana analysis on the `ip_addresses` field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2020, 9:22am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041/3 "2020-01-06T09:22:38Z")

</div>

Closed on January 6, 2020, 9:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.