Skip to content

Instantly share code, notes, and snippets.

@tsouza
Last active September 8, 2017 22:46
Show Gist options
  • Save tsouza/616a706b52d2482fc63372acce344079 to your computer and use it in GitHub Desktop.
Save tsouza/616a706b52d2482fc63372acce344079 to your computer and use it in GitHub Desktop.
POST _search/template/files_per_host
{
"template": {
"query": {
"indices": {
"indices": [
"<vcp-logstash-{now}>",
"<vcp-logstash-{now-1h}>"
],
"query": {
"range": {
"@timestamp": {
"gte": "now-1h",
"lt": "now"
}
}
},
"no_match_query": "none"
}
},
"aggs": {
"per_host": {
"terms": {
"field": "beat.hostname.keyword",
"size": 6000
},
"aggs": {
"per_file": {
"terms": {
"field": "source.keyword",
"size": 6000
},
"aggs": {
"per_minute": {
"date_histogram": {
"field": "@timestamp",
"interval": "minute"
}
}
}
}
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment