Elasticsearch uniq http dst by src

elasticsearch_uniq_http_dst_by_src.json

GET _search
{
  "size": 0,
  "aggs": {
    "2": {
      "terms": {
        "field": "sflow_ipv4_src",
        "size": 10,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "cardinality": {
            "field": "sflow_ipv4_dst"
          }
        }
      }
    }
  },
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "sflow_tcp_dst_port:80",
          "analyze_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "query": {
                "query_string": {
                  "analyze_wildcard": true,
                  "query": "*"
                }
              }
            },
            {
              "range": {
                "@timestamp": {
                  "gte": "now-1d"
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }
  }
}

search_result.json

{
   "took": 166,
   "timed_out": false,
   "_shards": {
      "total": 29,
      "successful": 29,
      "failed": 0
   },
   "hits": {
      "total": 33378,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "2": {
         "doc_count_error_upper_bound": -1,
         "sum_other_doc_count": 16013,
         "buckets": [
            {
               "1": {
                  "value": 3515
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 3636
            },
            {
               "1": {
                  "value": 132
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 345
            },
            {
               "1": {
                  "value": 78
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 84
            },
            {
               "1": {
                  "value": 45
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 63
            },
            {
               "1": {
                  "value": 38
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 6290
            },
            {
               "1": {
                  "value": 36
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 40
            },
            {
               "1": {
                  "value": 31
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 148
            },
            {
               "1": {
                  "value": 27
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 103
            },
            {
               "1": {
                  "value": 27
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 762
            },
            {
               "1": {
                  "value": 17
               },
               "key": "93.158.xxx.xxx",
               "doc_count": 5894
            }
         ]
      }
   }
}