# Problems with aggregation query

**URL:** <https://discuss.elastic.co/t/problems-with-aggregation-query/22165>\
**Category:** Elasticsearch\
**Created:** [February 14, 2015, 1:40am UTC](https://discuss.elastic.co/t/problems-with-aggregation-query/22165 "2015-02-14T01:40:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ian\_Hayes](https://avatars.discourse-cdn.com/v4/letter/i/ccd318/32.png) [@Ian\_Hayes](https://discuss.elastic.co/u/Ian_Hayes)\
**Post date:** [February 14, 2015, 1:40am UTC](https://discuss.elastic.co/t/problems-with-aggregation-query/22165/1 "2015-02-14T01:40:17Z")

</div>

I'm having a difficult time trying to get what is a simple SQL query to  
work with Elasticsearch. I can query, I can get counts, but can't seem to  
get the aggregation to work.

For a simple SQL query: select source\_ip, count(\*) from my\_table where  
destination port='23' group by source\_ip;

I've spent the day looking over documentation and examples, but just about  
all of the examples I have seen don't seem to utilize a filter and  
aggregate the entire index.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d049ac60-cb1e-4d66-9e94-8b8f9093b9c2%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d049ac60-cb1e-4d66-9e94-8b8f9093b9c2%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Eike\_Dehling](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eike\_Dehling](https://discuss.elastic.co/u/Eike_Dehling)\
**Post date:** [February 14, 2015, 8:07am UTC](https://discuss.elastic.co/t/problems-with-aggregation-query/22165/2 "2015-02-14T08:07:26Z")

</div>

Assuming the source\_ip field is unanalyzed, your query could be something  
like this:

{  
'query': {  
'terms': {  
'port': [23]  
}  
},  
'size': 0,  
'aggs': {  
'counts\_per\_ip': {  
'terms': {  
'field': 'source\_ip'  
}  
}  
}  
}

On Saturday, February 14, 2015 at 2:40:17 AM UTC+1, Ian Hayes wrote:

> I'm having a difficult time trying to get what is a simple SQL query to  
> work with Elasticsearch. I can query, I can get counts, but can't seem to  
> get the aggregation to work.
> 
> For a simple SQL query: select source\_ip, count(\*) from my\_table where  
> destination port='23' group by source\_ip;
> 
> I've spent the day looking over documentation and examples, but just about  
> all of the examples I have seen don't seem to utilize a filter and  
> aggregate the entire index.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/a51a023a-c4e5-4e69-b26e-427ccba748c1%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a51a023a-c4e5-4e69-b26e-427ccba748c1%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:32am UTC](https://discuss.elastic.co/t/problems-with-aggregation-query/22165/3 "2017-07-06T00:32:48Z")

</div>