# Way to override the doc\_count based aggregation

**URL:** <https://discuss.elastic.co/t/way-to-override-the-doc-count-based-aggregation/29552>\
**Category:** Elasticsearch\
**Created:** [September 18, 2015, 9:17am UTC](https://discuss.elastic.co/t/way-to-override-the-doc-count-based-aggregation/29552 "2015-09-18T09:17:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kpkvarma](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@kpkvarma](https://discuss.elastic.co/u/kpkvarma)\
**Post date:** [September 18, 2015, 9:17am UTC](https://discuss.elastic.co/t/way-to-override-the-doc-count-based-aggregation/29552/1 "2015-09-18T09:17:58Z")

</div>

{  
"date": "2015-06-25T17:20:20",  
"ip": "192.138.63.233",  
"ec": "106023",  
"sip": "160.141.161.137",  
"sport": "57735",  
"dip": "128.44.113.244",  
"dport": "389",  
"proto": "udp",  
“bytesin”: 125,  
“bytesout”: 250  
}  
{  
"date": "2015-06-25T17:20:20",  
"ip": "192.138.63.233",  
"ec": "106023",  
"sip": "160.141.162.162",  
"sport": "53576",  
"siface": "inside",  
"dip": "160.141.147.78",  
"dport": "389",  
"proto": "udp",  
“bytesin”: 225,  
“bytesout”: 550  
}

I am a bit new to Elastic Search, We would like to run few aggregations on the above indexed documents.

Our intention is to get the top 10 "dip" fields which are having maximum sum of "bytesin" data.  
My query in sql will be like "select dip, sum(bytesin) data from table group by dip order by sum(bytesin) desc".

currently I am running below GET request in Elastic Search but it is not providing what exactly the above sql query gives.

"aggs": {  
"top-sip": {  
"terms": {  
"field": "dip",  
"size": 10,  
"order": {  
"totalbytes": "desc"  
}  
},  
"aggs": {  
"totalbytes": {  
"sum": {  
"field" : "bytesin"  
}  
}  
}  
}  
}

The above aggregation retrieves the top 10 "dips" with respect to doc\_count and then it aggregates the "bytesin" field for those top "dips".

But what I expect(sql query) is, group the "dips" and aggregates the "bytesin" field for the grouped dip's. Finally it retreive the top 10 dips with respect to sum(bytesin). This is a way to override the default aggregation on ‘doc\_count’ of a field. For my use-case, identifying the top dips which are involved in consuming highest bandwidth (here bytesin field).

Can any one suggest me how to execute the aggregation to get the expected result.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:49pm UTC](https://discuss.elastic.co/t/way-to-override-the-doc-count-based-aggregation/29552/2 "2017-07-05T23:49:28Z")

</div>

Closed on July 5, 2017, 11:49pm UTC