# Is it possible to include other fields in the top level term aggregation

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528>\
**Category:** Kibana\
**Created:** [May 20, 2021, 12:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528 "2021-05-20T12:10:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![chapmantrain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chapmantrain/32/22646_2.png) [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Post date:** [May 20, 2021, 12:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/1 "2021-05-20T12:10:59Z")

</div>

I'm doing an aggregation on devices and calculating a metric on each. Is there a way to include other fields for the device in that top bucket like id, city, state? Each document in the vn-aggr index has those fields in it.

```auto
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "dttm": {
              "gte": "now-24h",
              "lte": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "resources": {
      "terms": {
        "field": "displayname.keyword",
        "size": 10
      },
      "aggs": {
        "90_inpeak": {
          "percentiles": {
            "field": "inpeak_util",
            "percents": [
              90
            ]
          }
        }
      }
    }
  }
}

```

The result is:

```auto
{
  "took" : 21687,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 17984980,
    "max_score" : 0.0,
    "hits" : []
  },
  "aggregations" : {
    "resources" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 17939432,
      "buckets" : [
        {
          "key" : "c4a24244_utp ethernet (10/100)",
          "doc_count" : 378,
          "90_inpeak" : {
            "values" : {
              "90.0" : 0.01721082963049412
            }
          }
        },
        {
          "key" : "c0a24244_utp ethernet (10/100)",
          "doc_count" : 360,
          "90_inpeak" : {
            "values" : {
              "90.0" : 0.004095323150977492
            }
          }
        },.....

```

Is there a way to include those identifiers in the term bucket like:

```auto
        {
          "key" : "c4a24244_utp ethernet (10/100)",
          "resourceid" : "1234",
          "city" : "Houston",
          "state" : "TX",
          "doc_count" : 378,
          "90_inpeak" : {
            "values" : {
              "90.0" : 0.01721082963049412
            }
          }
        },

```

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [May 20, 2021, 12:33pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/2 "2021-05-20T12:33:17Z")

</div>

You can use the "top hits" aggregation to do this

---

<div class="post-metadata">

**Author:** ![chapmantrain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chapmantrain/32/22646_2.png) [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Post date:** [May 26, 2021, 12:54pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/3 "2021-05-26T12:54:22Z")

</div>

Perfect, thanks Joe. However, when I include the \_id value, I'm getting this warning. I'm not real sure what it is telling me. I'm on v 6.8 but we're migrating to 7.x soon.

```auto
GET vn-aggr/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "dttm": {
              "gte": "now-4h",
              "lte": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "resources": {
      "terms": {
        "field": "displayname.keyword",
        "size": 10
      },
      "aggs": {
        "top_flds": {
          "top_hits": {
            "docvalue_fields": [
              "_id"
              ], 
            "_source": {
              "includes": [
                "syslocation",
                "tz-name",
                "a_device_hostname",
                "a_device_ip",
                "ifspeed",
                "resourceidelk"
              ]
            },
            "size": 1
          }
        },
        "avg_inpeak": {
          "avg": {
            "field": "inpeak_util"
          }
        },

```

#! Deprecation: There are doc-value fields which are not using a format. The output will change in 7.0 when doc value fields get formatted based on mappings by default. It is recommended to pass [format=use\_field\_mapping] with a doc value field in order to opt in for the future behaviour and ease the migration to 7.0: [\_id]

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [May 26, 2021, 2:37pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/4 "2021-05-26T14:37:25Z")

</div>

Unfortunately I'm not an expert on Elasticsearch - I know `_id` behaves weird in a bunch of places, not sure about this one in particular. I think it's worth opening a separate post in the Elasticsearch forum [Elasticsearch - Discuss the Elastic Stack](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6)

---

<div class="post-metadata">

**Author:** ![chapmantrain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chapmantrain/32/22646_2.png) [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\
**Post date:** [May 28, 2021, 2:01pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/5 "2021-05-28T14:01:27Z")

</div>

OK. Thanks Joe

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2021, 2:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-other-fields-in-the-top-level-term-aggregation/273528/6 "2021-06-25T14:02:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.