[elasticsearch笔记] aggregation-global/ip

global

global 表示查询过滤条件不起作用，会以所有数据为基础做聚合

GET kibana_sample_data_flights/_search?size=1
{
  "query": {
    "term": {
      "DestCountry": "IT"
    }
  },
  "aggs": {
    "global_value_count_dest": {
      "global": {},
      "aggs": {
        "aggs_value_count_dest": {
          "value_count": {
            "field": "OriginWeather"
          }
        }
      }
    },
    "clear_value_count_dest": {
      "value_count": {
        "field": "OriginWeather"
      }
    }
  }
}

ip

#
# CIDR mask
# 223.87.60.27/25
# 223.87.60.27/11111111 11111111 11111111 10000000
# 227.87.60.0
#
GET kibana_sample_data_logs/_search
{
  "size": 0,
  "aggs": {
    "ip_ranges": {
      "ip_range": {
        "field":"ip",
        "ranges":[
          {"to":"100.0.0.0","key":"part-1"},
          {"from":"100.0.0.0","key":"part-2"},
          {"mask":"223.87.60.27/25"},
          {"mask":"120.49.143.213/25"}
        ]
      }
    }
  }
}