# Unable to perform aggregation on 2 fields

**URL:** <https://discuss.elastic.co/t/unable-to-perform-aggregation-on-2-fields/96823>\
**Category:** Elasticsearch\
**Created:** [August 11, 2017, 8:02pm UTC](https://discuss.elastic.co/t/unable-to-perform-aggregation-on-2-fields/96823 "2017-08-11T20:02:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsur1](https://avatars.discourse-cdn.com/v4/letter/n/2acd7d/32.png) [@nsur1](https://discuss.elastic.co/u/nsur1)\
**Post date:** [August 11, 2017, 8:02pm UTC](https://discuss.elastic.co/t/unable-to-perform-aggregation-on-2-fields/96823/1 "2017-08-11T20:02:09Z")

</div>

I am trying to find a unique count on a pair of source and destination IPs in my stored records.  
In elastic search, the mapping shows that the fields are being stored as an IP type, however when I try to compare the 2 IPs, to sort them, Elasticsearch throws an error, saying

```
"Cannot apply [>] operation to types [org.elasticsearch.index.mapper.IpFieldMapper.IpFieldType.IpScriptDocValues] and [org.elasticsearch.index.mapper.IpFieldMapper.IpFieldType.IpScriptDocValues]." 

```

The reason I want to do this is because in some records in which the same IPs are stored, however in different srcIP and dstIP fields. I would like to eventually create a visualization based on the top 10 pairs but to do that, I must first try to figure this out.

Do you guys have any suggestions? This is my query so far... It's a little messy:

```
"aggs" : {
	"ip_pairs" : {
		"cardinality" : { 
			"script" : "if (doc['srcIP'] > doc['dstIP']) { doc['dstIP'].value + '-' + doc['srcIP'].value } else { doc['srcIP'].value + '-' + doc['dstIP'].value }"
		}

	}
}
```

---

<div class="post-metadata">

**Author:** ![xavierfacq](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavierfacq/32/8744_2.png) [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\
**Post date:** [August 11, 2017, 8:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-aggregation-on-2-fields/96823/2 "2017-08-11T20:44:56Z")

</div>

Maybe should you look at the available methods in the class corresponding to the error?

```
IpScriptDocValues
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2017, 8:45pm UTC](https://discuss.elastic.co/t/unable-to-perform-aggregation-on-2-fields/96823/3 "2017-09-08T20:45:17Z")

</div>

Closed on September 8, 2017, 8:45pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.