Elasticserach7.x多字段组合聚合查询

curl -H "Content-Type: application/json" -X POST 'localhost:9200/records/_search?pretty' -d '
{
  //过滤条件
	"query": {
		"bool": {
			"must": [{
					"match_phrase": {
						"fwname": {
							"query": "10.227.5.22:9000"
						}
					}
				},
				{
					"match_phrase": {
						"destinationisp": {
							"query": "电信"
						}
					}
				}
			]
		}
	},
 //聚合条件
	"aggs":{
		"srcaddr":{
			"terms":{
				"script":{
					"source":"doc[\u0027sourcesystem\u0027].value + \u0027#\u0027 + doc[\u0027source_address\u0027].value + \u0027#\u0027 + doc[\u0027destination_address\u0027].value + \u0027#\u0027 + doc[\u0027destination_port\u0027].value + \u0027#\u0027 + doc[\u0027destinationcountry\u0027].value + \u0027#\u0027 + doc[\u0027destinationcity\u0027].value + \u0027#\u0027 + doc[\u0027destinationisp\u0027].value",
					"lang":"painless"
				},
    //聚合结果返回的最大条数
				"size": 100000
			}
		}
	},
 //查询结果返回的最大条数
	"size": 0
}
'