7
7
8
8
[source,js]
9
9
--------------------------------------------------
10
+ GET /ip_addresses/data/_search
10
11
{
12
+ "size": 10,
11
13
"aggs" : {
12
14
"ip_ranges" : {
13
15
"ip_range" : {
@@ -21,6 +23,8 @@ Example:
21
23
}
22
24
}
23
25
--------------------------------------------------
26
+ // CONSOLE
27
+ // TEST[setup:iprange]
24
28
25
29
Response:
26
30
@@ -34,23 +38,26 @@ Response:
34
38
"buckets" : [
35
39
{
36
40
"to": "10.0.0.5",
37
- "doc_count": 4
41
+ "doc_count": 10
38
42
},
39
43
{
40
44
"from": "10.0.0.5",
41
- "doc_count": 6
45
+ "doc_count": 260
42
46
}
43
47
]
44
48
}
45
49
}
46
50
}
47
51
--------------------------------------------------
52
+ // TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
48
53
49
54
IP ranges can also be defined as CIDR masks:
50
55
51
56
[source,js]
52
57
--------------------------------------------------
58
+ GET /ip_addresses/data/_search
53
59
{
60
+ "size": 0,
54
61
"aggs" : {
55
62
"ip_ranges" : {
56
63
"ip_range" : {
@@ -64,44 +71,51 @@ IP ranges can also be defined as CIDR masks:
64
71
}
65
72
}
66
73
--------------------------------------------------
74
+ // CONSOLE
75
+ // TEST[setup:iprange]
67
76
68
77
Response:
69
78
70
79
[source,js]
71
80
--------------------------------------------------
72
81
{
82
+ ...
83
+
73
84
"aggregations": {
74
85
"ip_ranges": {
75
86
"buckets": [
76
87
{
77
88
"key": "10.0.0.0/25",
78
89
"from": "10.0.0.0",
79
- "to": "10.0.0.127 ",
80
- "doc_count": 127
90
+ "to": "10.0.0.128 ",
91
+ "doc_count": 128
81
92
},
82
93
{
83
94
"key": "10.0.0.127/25",
84
95
"from": "10.0.0.0",
85
- "to": "10.0.0.127 ",
86
- "doc_count": 127
96
+ "to": "10.0.0.128 ",
97
+ "doc_count": 128
87
98
}
88
99
]
89
100
}
90
101
}
91
102
}
92
103
--------------------------------------------------
104
+ // TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
93
105
94
106
==== Keyed Response
95
107
96
108
Setting the `keyed` flag to `true` will associate a unique string key with each bucket and return the ranges as a hash rather than an array:
97
109
98
110
[source,js]
99
111
--------------------------------------------------
112
+ GET /ip_addresses/data/_search
100
113
{
114
+ "size": 0,
101
115
"aggs": {
102
116
"ip_ranges": {
103
117
"ip_range": {
104
- "field": "remote_ip ",
118
+ "field": "ip ",
105
119
"ranges": [
106
120
{ "to" : "10.0.0.5" },
107
121
{ "from" : "10.0.0.5" }
@@ -112,6 +126,8 @@ Setting the `keyed` flag to `true` will associate a unique string key with each
112
126
}
113
127
}
114
128
--------------------------------------------------
129
+ // CONSOLE
130
+ // TEST[setup:iprange]
115
131
116
132
Response:
117
133
@@ -125,27 +141,30 @@ Response:
125
141
"buckets": {
126
142
"*-10.0.0.5": {
127
143
"to": "10.0.0.5",
128
- "doc_count": 1462
144
+ "doc_count": 10
129
145
},
130
146
"10.0.0.5-*": {
131
147
"from": "10.0.0.5",
132
- "doc_count": 50000
148
+ "doc_count": 260
133
149
}
134
150
}
135
151
}
136
152
}
137
153
}
138
154
--------------------------------------------------
155
+ // TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
139
156
140
157
It is also possible to customize the key for each range:
141
158
142
159
[source,js]
143
160
--------------------------------------------------
161
+ GET /ip_addresses/data/_search
144
162
{
163
+ "size": 0,
145
164
"aggs": {
146
165
"ip_ranges": {
147
166
"ip_range": {
148
- "field": "remote_ip ",
167
+ "field": "ip ",
149
168
"ranges": [
150
169
{ "key": "infinity", "to" : "10.0.0.5" },
151
170
{ "key": "and-beyond", "from" : "10.0.0.5" }
@@ -156,6 +175,8 @@ It is also possible to customize the key for each range:
156
175
}
157
176
}
158
177
--------------------------------------------------
178
+ // CONSOLE
179
+ // TEST[setup:iprange]
159
180
160
181
Response:
161
182
@@ -169,14 +190,15 @@ Response:
169
190
"buckets": {
170
191
"infinity": {
171
192
"to": "10.0.0.5",
172
- "doc_count": 1462
193
+ "doc_count": 10
173
194
},
174
195
"and-beyond": {
175
196
"from": "10.0.0.5",
176
- "doc_count": 50000
197
+ "doc_count": 260
177
198
}
178
199
}
179
200
}
180
201
}
181
202
}
182
203
--------------------------------------------------
204
+ // TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
0 commit comments