If it were the sum of the sub queries tooks, a total took of 10ms might actually be 10 queries in parallel taking 1ms to complete in parallel, thus the time taken is really 1ms.
took is the total time it took ES to process the query (i.e. aggregate sub queries per shard).
It does not include
serializing the request into JSON on the client
sending the request over the network
deserializing the request from JSON on the server
serializing the response into JSON on the server
sending the response over the network
deserializing the response from JSON on the client