[ ... ] for my $hit ( map { $_->{'_source'} } @{ $results->{'hits'}->{'hits'} } ) { $interesting{ $hit->{'request'} }->{ $hit->{'clientip'} }++; } for my $resource ( keys %interesting ) { say "Resource: $resource"; foreach my $ip ( keys %{ $interesting{ $resource } } ) { say "\t$ip made $interesting{ $resource }->{ $ip } requests"; } }