Chain aggregations
{
"size": 0,
"query": {
"match": {
"type.keyword": "custom"
}
},
"aggregations": {
"trx_over_time": {
"date_histogram": {
"field": "@timestamp",
"interval": "1h"
},
"aggs": {
"origin": {
"terms": {
"field": "origin.name.keyword"
},
"aggs": {
"online": {
"sum": {
"field": "origin.online"
}
},
"offline": {
"sum": {
"field": "origin.offline"
}
}
}
}
}
}
}
}