# How to do top\_hits aggregation after cardinality aggregation?

**URL:** <https://discuss.elastic.co/t/how-to-do-top-hits-aggregation-after-cardinality-aggregation/97096>\
**Category:** Elasticsearch\
**Created:** [August 15, 2017, 12:42pm UTC](https://discuss.elastic.co/t/how-to-do-top-hits-aggregation-after-cardinality-aggregation/97096 "2017-08-15T12:42:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![moabbas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moabbas/32/19231_2.png) [@moabbas](https://discuss.elastic.co/u/moabbas)\
**Post date:** [August 15, 2017, 12:42pm UTC](https://discuss.elastic.co/t/how-to-do-top-hits-aggregation-after-cardinality-aggregation/97096/1 "2017-08-15T12:42:43Z")

</div>

Hello  
I need to do top\_hits aggregation on the result of cardinality aggregation .  
Here is my aggregation:

> GET /logstash-2017.08.14/xms\_api\_station\_info/\_search?typed\_keys  
> {"size": 0,  
> "aggregations": {  
> "uniq\_mac": {  
> "cardinality": {  
> "field": "stationMacAddress.keyword"  
> },  
> "aggregations":{  
> "device\_type":{  
> "terms": {  
> "field": "deviceType.keyword",  
> "size": 10000000,  
> "order": {  
> "\_count": "desc"  
> }  
> },  
> "aggregations": {  
> "devic\_class": {  
> "terms": {  
> "field":"deviceClass.keyword"  
> },  
> "aggregations": {  
> "top\_users": {  
> "top\_hits": {  
> "size": 1  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }

But it gives me that.

> {  
> "error": {  
> "root\_cause": [  
> {  
> "type": "aggregation\_initialization\_exception",  
> "reason": "Aggregator [uniq\_mac] of type [cardinality] cannot accept sub-aggregations"  
> }  
> ],  
> "type": "aggregation\_initialization\_exception",  
> "reason": "Aggregator [uniq\_mac] of type [cardinality] cannot accept sub-aggregations"  
> },  
> "status": 500  
> }

Thanks,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2017, 12:42pm UTC](https://discuss.elastic.co/t/how-to-do-top-hits-aggregation-after-cardinality-aggregation/97096/2 "2017-09-12T12:42:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.