Elasticsearch aggregation on multi fields

Question

Here's an example of a document in my ES index:

{
  "src_ip": "192.168.1.1",
  "dst_ip": "192.168.1.2"
}

I want obtain the number of occurrences of ip in different documents(in field src_ip or dst_ip). What I would like to get as a result of the query is an aggregation like this:

[
  {"ip": "192.168.1.1", "count": 1"},
  {"ip": "192.168.1.2", "count": 1"}
]

Any idea about that? Thanks in advance for your help.

Ashish Tiwari · Accepted Answer · 2022-04-11 16:46:55Z

1

You need to use term aggregation, Where you will get the group counts.

POST index_name/_search?size=0
{
  "aggs": {
    "src_ip_count": {
      "terms": {
        "field": "src_ip"
      }
    },
    "dst_ip_count": {
      "terms": {
        "field": "dst_ip"
      }
    }
  }
}

Here i am assuming that the type of src_ip and dst_ip is keyword. If it's not, You need to store all value as keyword type.

edited Apr 11, 2022 at 16:46

answered Apr 11, 2022 at 16:38

Ashish Tiwari

2,3971 gold badge18 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

zwtop Over a year ago

Thanks for your reply! But the search returns two aggregation results, not one. Is possible to return one aggregation result, the aggregation key is all keywords in src_ip and dst_ip?

Ashish Tiwari Over a year ago

Yes it return two aggregations because you want group count on two individual field. To convert in specific format, I would recommend to handle programmatically. But i hope you getting desire results. Let me know.

Ashish Tiwari Over a year ago

Mark it answered if its really helped you. So that others can take reference :)

Collectives™ on Stack Overflow

Elasticsearch aggregation on multi fields

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related