Chain aggregations

{
  "size": 0,
  "query": {
    "match": {
      "type.keyword": "custom"
    }
  },
  "aggregations": {
    "trx_over_time": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h"
      },
      "aggs": {
        "origin": {
          "terms": {
            "field": "origin.name.keyword"
          },
          "aggs": {
            "online": {
              "sum": {
                "field": "origin.online"
              }
            },
            "offline": {
              "sum": {
                "field": "origin.offline"
              }
            }
          }
        }
      }
    }
  }
}