# How to count tuples of 3 variables, sorted

**URL:** https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309
**Category:** Elasticsearch
**Created:** [October 17, 2014, 6:43pm UTC](https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309 "2014-10-17T18:43:07Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Artur\_Martins](https://avatars.discourse-cdn.com/v4/letter/a/ac91a4/32.png) [@Artur\_Martins](https://discuss.elastic.co/u/Artur_Martins)
#### Post date: [October 17, 2014, 6:43pm UTC](https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309/1 "2014-10-17T18:43:07Z")

</div>

Greetings community,

I'm new to elasticsearch, so first of all sorry for my questions being so  
basic.

I developed a flow collector which dumps flows to my elasticsearch server.  
Right now i use Kibana to perform the Top 10 destination and Top 10 source  
IPs filters, and such.  
But the query I'm having more difficulties about is knowing the Top 10  
combination of (source + dest + dest\_port) so that I can know what the top  
flows are, and from which IPs and to which destinations and protocols.

Example:

{

> "aggs":{  
> "tupulo\_teste":{  
> "value\_count":{  
> "field":"SRC\_ADDR",  
> "field":"DST\_ADDR",  
> "field":"DST\_PORT"  
> }  
> }  
> }  
> }

This does not compute all combinations of (SRC\_ADDR, DST\_ADDR, DST\_PORT)  
nor even sort it giving the Top10 hits. If you are familiar with splunk, I  
need the equivalent of "_stats count by a,b,c | sort 10 -count_"

I've tried:

> {  
> "aggs":{  
> "src":{  
> "terms":{"field": "SRC\_ADDR"},  
> "aggs":{  
> "dst":{  
> "terms":{"field": "DST\_ADDR"},  
> "aggs":{  
> "dstprt":{  
> "terms":{"field":  
> "DST\_PORT"}  
> }  
> }  
> }  
> }  
> }  
> }

but this produces a strange and long combination, also without sorting.

Can someone please help me on how to do this result combination, with a  
sort by occurence count?

Thank you

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f2c7bad6-dbd7-4edd-b3bd-a9cc6018e7a7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f2c7bad6-dbd7-4edd-b3bd-a9cc6018e7a7%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:55am UTC](https://discuss.elastic.co/t/how-to-count-tuples-of-3-variables-sorted/20309/2 "2017-07-06T00:55:26Z")

</div>