# Perform aggregation on already aggregated result

**URL:** <https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639>\
**Category:** Elasticsearch\
**Created:** [January 30, 2018, 2:39pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639 "2018-01-30T14:39:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![clindo](https://avatars.discourse-cdn.com/v4/letter/c/f0a364/32.png) [@clindo](https://discuss.elastic.co/u/clindo)\
**Post date:** [January 30, 2018, 2:39pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639/1 "2018-01-30T14:39:31Z")

</div>

Hello,

I am performing an aggregation of Netflow records. My first aggregation is to collect all documents within a "100ms" interval. Now I want to do an aggregation on a particular field in this interval, say protocol used during this interval. So, how could I structure a query so that, I can get the total number of docs in each interval along with the count of docs having the particular protocol?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2018, 2:43pm UTC](https://discuss.elastic.co/t/perform-aggregation-on-already-aggregated-result/117639/2 "2018-02-27T14:43:23Z")

</div>

Closed on February 27, 2018, 2:43pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.