# Sub aggregation

**URL:** <https://discuss.elastic.co/t/sub-aggregation/48562>\
**Category:** Elasticsearch\
**Created:** [April 27, 2016, 2:30pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562 "2016-04-27T14:30:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![maher](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@maher](https://discuss.elastic.co/u/maher)\
**Post date:** [April 27, 2016, 2:30pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/1 "2016-04-27T14:30:29Z")

</div>

Hi,  
i am trying to group all the visited product by each user.  
when i execute this aggregation:

```
 {
  "size":0,
  "aggs" : {
  "distinctroles": {
   "terms": {
    "field": "roles"
   },
   "aggs": {
    "consultedproducts": {
   "terms": {
   "field": "productcode"
      }
     }
   }
  }
 }
}

```

it returns all the roles and all the products:

```
 "buckets": [
        {
      "key": "role_customergroup",
      "doc_count": 3124,
      "consultedproducts": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "847942",
            "doc_count": 639
          },
          {
            "key": "1312640",
            "doc_count": 438
          },
          {
            "key": "458542",
            "doc_count": 438
          },
          {
            "key": "1992695",
            "doc_count": 224
          },
          {
            "key": "872912",
            "doc_count": 219
          },
          {
            "key": "2938458",
            "doc_count": 217
          },
          {
            "key": "4812254",
            "doc_count": 214
          },
          {
            "key": "824267",
            "doc_count": 214
          },
          {
            "key": "1776947",
            "doc_count": 205
          },
          {
            "key": "805693",
            "doc_count": 110
          }
        ]
      }
    },
    {
      "key": "role_pronto",
      "doc_count": 1945,
      "consultedproducts": {
        "doc_count_error_upper_bound": 0,
        "sum_other_doc_count": 0,
        "buckets": [
          {
            "key": "847942",
            "doc_count": 639
          },
          {
            "key": "1312640",
            "doc_count": 438
          },
          {
            "key": "458542",
            "doc_count": 438
          },
          {
            "key": "1992695",
            "doc_count": 224
          }
        ]
      }
    }
  }

```

am I doing something wrong?

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [April 27, 2016, 2:36pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/2 "2016-04-27T14:36:48Z")

</div>

What are you expecting to see? To get more help it would be helpful to get an idea of how the documents in that index look like. Maybe a sample doc or the mapping would help.

---

<div class="post-metadata">

**Author:** ![maher](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@maher](https://discuss.elastic.co/u/maher)\
**Post date:** [April 27, 2016, 2:41pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/3 "2016-04-27T14:41:52Z")

</div>

this is a doc example:

```
  {
     "_index": "dashboard",
     "_type": "logs",
    "_id": "AVRS3LjIqZBDXIAH7Wc2",
    "_score": 1,
    "fields": {
      "productcode": [
        "\"1992695\""
      ],
      "roles": [
        "\"ROLE_CUSTOMERGROUP,ROLE_PRONTO\""
      ]
    }
  }

```

this is a user that has different roles.  
that consulted this product "1992695".  
I need to get all the consulted products for each role.

I am expecting something like this:

```
"buckets": [
    {
  "key": "role_customergroup",
  "doc_count": 3124,
  "consultedproducts": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
      {
        "key": "847942",
        "doc_count": 639
      },
      {
        "key": "1312640",
        "doc_count": 438
      },
      {
        "key": "458542",
        "doc_count": 438
      },
      {
        "key": "872912",
        "doc_count": 219
      },
{
  "key": "role_pronto",
  "doc_count": 1945,
  "consultedproducts": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
      {
        "key": "1992695",
        "doc_count": 224
      }
    ]
  }
}

```

}

---

<div class="post-metadata">

**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\
**Post date:** [April 27, 2016, 3:01pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/4 "2016-04-27T15:01:00Z")

</div>

The response structure seems okay, to me, which part of the first response is wrong in your opinion? I you have a document with `"productcode" : "1992695"` and `"roles" : "ROLE_CUSTOMERGROUP,ROLE_PRONTO"` it will turn up in both bucket. Is that the problem you are facing?

---

<div class="post-metadata">

**Author:** ![maher](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@maher](https://discuss.elastic.co/u/maher)\
**Post date:** [April 27, 2016, 3:30pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/5 "2016-04-27T15:30:14Z")

</div>

Sorry bro,

it's an internal issue about roles

never mind 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:55pm UTC](https://discuss.elastic.co/t/sub-aggregation/48562/6 "2017-07-05T22:55:54Z")

</div>