I have the following data in elasticsearch. I want to aggregate based on "Dest IP" after matching for a particular value of "Source MAC Addr". How to achieve this using elasticsearch query from javascript.
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 1.0,
"hits" : [ {
"_index" : "logstash-1",
"_type" : "packet",
"_id" : "bcb57f445084cc0e474366bf892f6b4ab9162a4e",
"_score" : 1.0,
"_source" : {
"@source" : "logstash",
"@source_host" : "03",
"@message" : "72",
"@tags" : [ ],
"@fields" : {
"Protocol Type" : "TCP",
"Dst Domain" : "USER1",
"No" : 72,
"Timestamp" : "2016-11-08 10:46:57.691",
"Source IP" : "10.10.10.10",
"Source MAC Addr" : "00:00:00:00:00:00",
"Length" : 1480,
"Dest MAC Addr" : "ad:ad:ad:ad:ad:ad",
"Src -> Dst" : "10.10.10.10 -> 20.20.20.20",
"TTL" : 60,
"Src Domain" : "act",
"logger" : "logger",
"Dest IP" : "20.20.20.20",
"levelname" : "INFO",
"Size" : 100
},
}
}, {
"_index" : "logstash",
"_type" : "packet",
"_id" : "d6ff9ac16f70dc2c4b3d599c74489475db124fd7",
"_score" : 1.0,
"_source" : {
"message" : "aaaa\n",
"tags" : [ "_jsonparsefailure" ],
"@version" : "1",
"@timestamp" : "2016-11-08T04:11:30.663Z",
"type" : "packet",
"host" : "10.10.10.10",
"fingerprint" : "d6ff9ac16f70dc2c4b3d599c74489475db124fd7"
}
} ]
}
}
well this seems to be a query result, so it would have been convenient to also include that query, still i do not get what kind of aggregation you want, so a query filtered by IP and MAC should do the job, without aggregation, which also could be done by first filtering by IP Adress and then aggregate
"aggs": {
"by_mac_addr": {
"terms": {
"field": "Source MAC Addr",
"order": {
"_term": "asc"
},
"size": 1000
}
}
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.