GET an_ECS_index/_search
{
  "size": 0,
  "aggs": {
    "1-bucket": {
      "ip_range": {
        "field": "destination.ip",
        "ranges": [
          {
            "mask": "192.168.0.0/16"
          },
          {
            "mask": "10.10.0.0/16"
          }
        ],
        "keyed": false
      }, 
      "aggs": {
        "1-metric": {
          "sum": {
            "field": "source.bytes"
          }
        }
      }
    },
    "1": {
      "sum_bucket": {
        "buckets_path": "1-bucket>1-metric"
      }
    }
  }
}

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "The first aggregation in buckets_path must be a multi-bucket aggregation for aggregation [1] found :org.elasticsearch.search.aggregations.bucket.range.IpRangeAggregationBuilder for buckets path: 1-bucket>1-metric"
      }