# Return \_source fields within aggregation

**URL:** <https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697>\
**Category:** Elasticsearch\
**Created:** [November 7, 2017, 2:15pm UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697 "2017-11-07T14:15:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kornelia\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@Kornelia\_Watson](https://discuss.elastic.co/u/Kornelia_Watson)\
**Post date:** [November 7, 2017, 2:15pm UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697/1 "2017-11-07T14:15:40Z")

</div>

Hi all,

In my ES indices I have an order type, which as you can guess stores various data about orders.  
What I need to do is create a query such that: it splits data using scripted field, and then sums up order values within created buckets, as well as returns information such as currency, account id, channel the order came from etc which would be in \_source...

I can prepare this query through Kibana visualisation but it ends up having a lot of unnecessary aggregations. I tried to use top\_hits but with no success... I wondered, are there limitations to what type of aggregations top\_hits can be used or is it just most likely me writing the query incorrectly?

Thanks,  
Kornelia

---

<div class="post-metadata">

**Author:** ![jimczi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jimczi/32/47985_2.png) [@jimczi](https://discuss.elastic.co/u/jimczi)\
**Post date:** [November 8, 2017, 11:33am UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697/2 "2017-11-08T11:33:25Z")

</div>

Can you share the aggregation that you tried ? The `top_hits` aggregation can be used as a root aggregation or under a `multi_bucket` aggregation (`terms` for instance).

---

<div class="post-metadata">

**Author:** ![Kornelia\_Watson](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@Kornelia\_Watson](https://discuss.elastic.co/u/Kornelia_Watson)\
**Post date:** [November 9, 2017, 9:08am UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697/3 "2017-11-09T09:08:39Z")

</div>

Might be easier to maybe show the query that Kibana suggests, which is:

> ```
> {
> "query": {
> "bool": {
> "must": [
> {
> "query_string": {
> "analyze_wildcard": true,
> "query": "some query"
> }
> },
> {
> "range": {
> "date": {
> "gte": 1447058731436,
> "lte": 1510217131436,
> "format": "epoch_millis"
> }
> }
> }
> ]
> }
> },
> "size": 0,
> "aggs": {
> "id": {
> "terms": {
> "script": {
> "inline": "some scripted field",
> "lang": "painless"
> },
> "size": 500000,
> "order": {
> "_count": "desc"
> },
> "value_type": "string"
> },
> "aggs": {
> "account_id": {
> "terms": {
> "field": "account_id",
> "size": 1,
> "order": {
> "_count": "desc"
> }
> },
> "aggs": {
> "channel": {
> "terms": {
> "field": "channel_description",
> "size": 1,
> "order": {
> "_count": "desc"
> }
> },
> "aggs": {
> "base_currency": {
> "terms": {
> "field": "base_currency",
> "size": 1,
> "order": {
> "_count": "desc"
> }
> },
> "aggs": {
> "gmv": {
> "sum": {
> "field": "value_base"
> }
> }
> }
> }
> }
> }
> }
> }
> }
> }
> }
> }
> 
> ```

And the output is

> ```
> {
> "aggregations": {
> "id": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "key": "acc-channel-10-2017",
> "doc_count": 2670,
> "account_id": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "key": "some account",
> "doc_count": 2670,
> "channel": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "key": "some channel",
> "doc_count": 2670,
> "base_currency": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "key": "some currency",
> "doc_count": 2670,
> "gmv": {
> "value": some gmv value
> }
> }
> ]
> }
> }
> ]
> }
> }
> ]
> }
> }
> ]
> }
> }
> }
> 
> ```

So there are a lot of subbuckets. What I wondered is if after performing two aggregations (to retrieve id and gmv) I can then somehow access other values like account\_id, channel and base\_currency without having to do all those subaggregations

---

<div class="post-metadata">

**Author:** ![jimczi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jimczi/32/47985_2.png) [@jimczi](https://discuss.elastic.co/u/jimczi)\
**Post date:** [November 9, 2017, 10:47pm UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697/4 "2017-11-09T22:47:44Z")

</div>

The aggregation named "gmv" in your example is a `sum` aggregation. It is a metric aggregation which in your case computes a sum of the field `value_base` for every `id.account_id.channel. base_currency` bucket created by the tree of `terms` aggregation at the upper levels. It is a single value that is computed based on the documents that are contained in the bucket. The value for account\_id, channel and base\_currency are already in the response. The values are the key of the parent buckets above each `gmv` result.  
The `top_hits` aggregation returns the top N documents per bucket. It is not a single valued metric like the `sum` aggregation and is not needed in your case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2017, 10:47pm UTC](https://discuss.elastic.co/t/return-source-fields-within-aggregation/106697/5 "2017-12-07T22:47:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.