弹性搜索：基于模式聚合文档

Question

I have four documents in my index. These are as follows.

Client(::ffff:10.0.0.6:27787) Connected

Client(::ffff:10.0.0.6:27805) Connected

Client(::ffff:10.0.0.6:27823) Connected

Client(::ffff:10.0.0.6:27875) Connected

=================

I hope to aggregate these as follows.

Client(::ffff:10.0.0.6:_____) Connected

There are many documents with different patterns in an index, not only the above document pattern, and I hope to get all patterns by aggregating all documents in an index.

How can I do it with ES? If ES does not directly support such aggregations, any idea to do this?

Regards, Kangmo

Answer 1

you need to split the data you index into specific fields for, in order to reliable aggregate on your data.

So, you need to have a process, that splits the string Client(::ffff:10.0.0.6:27787) Connected into ::ffff:10.0.0.6 and puts that content into its own field.

One possible way to do this is to use the ingest node. The ingest node has a so-called grok processor to extract structured data from text.

With this you could extract the ip address and the index it into its own field (you could also use the ip data type, so you can do CIDR style range queries if needed) - and then you can aggregate easily on that data.

Hope this helps!

--Alex