Might be easier to maybe show the query that Kibana suggests, which is:
{
"query": {
"bool": {
"must": [
{
"query_string": {
"analyze_wildcard": true,
"query": "some query"
}
},
{
"range": {
"date": {
"gte": 1447058731436,
"lte": 1510217131436,
"format": "epoch_millis"
}
}
}
]
}
},
"size": 0,
"aggs": {
"id": {
"terms": {
"script": {
"inline": "some scripted field",
"lang": "painless"
},
"size": 500000,
"order": {
"_count": "desc"
},
"value_type": "string"
},
"aggs": {
"account_id": {
"terms": {
"field": "account_id",
"size": 1,
"order": {
"_count": "desc"
}
},
"aggs": {
"channel": {
"terms": {
"field": "channel_description",
"size": 1,
"order": {
"_count": "desc"
}
},
"aggs": {
"base_currency": {
"terms": {
"field": "base_currency",
"size": 1,
"order": {
"_count": "desc"
}
},
"aggs": {
"gmv": {
"sum": {
"field": "value_base"
}
}
}
}
}
}
}
}
}
}
}
}
And the output is
{
"aggregations": {
"id": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "acc-channel-10-2017",
"doc_count": 2670,
"account_id": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "some account",
"doc_count": 2670,
"channel": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "some channel",
"doc_count": 2670,
"base_currency": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "some currency",
"doc_count": 2670,
"gmv": {
"value": some gmv value
}
}
]
}
}
]
}
}
]
}
}
]
}
}
}
So there are a lot of subbuckets. What I wondered is if after performing two aggregations (to retrieve id and gmv) I can then somehow access other values like account_id, channel and base_currency without having to do all those subaggregations