elasticsearch - Elastic Search (COUNT*) with group by and where condition -
dear elastic serach users,
i newbie in elasticsearch.
i confused how convert following sql command elasticsearch dsl query ? can assist me.
select ip, count(*) c elastic date between '2016-08-20 00:00:00' , '2016-08-22 13:41:09' , service='http' , destination='10.17.102.1' group ip order c desc;
thank you
the following query achieve want, i.e. select documents within desired date
range , required service
, destination
, run terms
aggregation (=group by) on ip
field , order latter in decreasing count order.
{ "size": 0, "query": { "bool": { "filter": [ { "range": { "date": { "gt": "2016-08-22t00:00:00.000z", "lt": "2016-08-22t13:41:09.000z" } } }, { "term": { "service": "http" } }, { "term": { "destination": "10.17.102.1" } } ] } }, "aggs": { "group_by_ip": { "terms": { "field": "ip" } } } }
Comments
Post a Comment