elasticsearch - Elastic Search (COUNT*) with group by and where condition -


dear elastic serach users,

i newbie in elasticsearch.

i confused how convert following sql command elasticsearch dsl query ? can assist me.

select ip, count(*) c  elastic  date  between '2016-08-20  00:00:00' , '2016-08-22 13:41:09'  , service='http' , destination='10.17.102.1' group ip order c desc; 

thank you

the following query achieve want, i.e. select documents within desired date range , required service , destination , run terms aggregation (=group by) on ip field , order latter in decreasing count order.

{   "size": 0,   "query": {     "bool": {       "filter": [         {           "range": {             "date": {               "gt": "2016-08-22t00:00:00.000z",               "lt": "2016-08-22t13:41:09.000z"             }           }         },         {           "term": {             "service": "http"           }         },         {           "term": {             "destination": "10.17.102.1"           }         }       ]     }   },   "aggs": {     "group_by_ip": {       "terms": {         "field": "ip"       }     }   } } 

Comments

Popular posts from this blog

mysql - Dreamhost PyCharm Django Python 3 Launching a Site -

java - Sending SMS with SMSLib and Web Services -

java - How to resolve The method toString() in the type Object is not applicable for the arguments (InputStream) -