Elasticsearch query examples

es.json

/* Simple query */

{
    "query": {
        "bool": {
            "must": {
                "match": {
                    "host": "10.168.233.28"
                }
            }
        }
    }
}

/* Multiple conditions */

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "host": "10.168.233.28"
                    }
                },
                {
                    "match": {
                        "severity_label": "Notice"
                    }
                }
            ]
        }
    }
}

/* Simple aggregation */

{
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "host": "10.168.233.28"
                    }
                },
                {
                    "match": {
                        "severity_label": "Notice"
                    }
                }
            ]
        }
    },
    "aggs": {
        "severity_agg": {
            "terms": {
                "field": "severity_label"
            }
        }
    }
}

/* Unique count (cardinality) */

{
    "size": 1,
    "query": {
        "bool": {
            "must": [
                {
                    "match": {
                        "severity_label": "Notice"
                    }
                }
            ]
        }
    },
    "aggs": {
        "severity_agg": {
            "cardinality": {
                "field": "host"
            }
        }
    }
}

/* Multiple aggregations */

{
    "size": 1,
    "query": {
        "match_all": {}
    },
    "aggs": {
        "day": {
            "date_histogram": {
                "field": "@timestamp",
                "interval": "day"
            },
            "aggs": {
                "severity": {
                    "terms": {
                        "field": "severity"
                    },
                    "aggs": {
                        "host": {
                            "cardinality": {
                                "field": "host"
                            }
                        }
                    }
                }
            }
        }
    }
}