curl -H "Content-Type: application/json" -X POST 'localhost:9200/records/_search?pretty' -d '
{
//过滤条件
"query": {
"bool": {
"must": [{
"match_phrase": {
"fwname": {
"query": "10.227.5.22:9000"
}
}
},
{
"match_phrase": {
"destinationisp": {
"query": "电信"
}
}
}
]
}
},
//聚合条件
"aggs":{
"srcaddr":{
"terms":{
"script":{
"source":"doc[\u0027sourcesystem\u0027].value + \u0027#\u0027 + doc[\u0027source_address\u0027].value + \u0027#\u0027 + doc[\u0027destination_address\u0027].value + \u0027#\u0027 + doc[\u0027destination_port\u0027].value + \u0027#\u0027 + doc[\u0027destinationcountry\u0027].value + \u0027#\u0027 + doc[\u0027destinationcity\u0027].value + \u0027#\u0027 + doc[\u0027destinationisp\u0027].value",
"lang":"painless"
},
//聚合结果返回的最大条数
"size": 100000
}
}
},
//查询结果返回的最大条数
"size": 0
}
'
Elasticserach7.x多字段组合聚合查询
最新推荐文章于 2024-08-13 23:11:18 发布