search_template

POST _search/template/files_per_host
{
  "template": {
    "query": {
      "indices": {
        "indices": [
          "<vcp-logstash-{now}>",
          "<vcp-logstash-{now-1h}>"
        ],
        "query": {
          "range": {
            "@timestamp": {
              "gte": "now-1h",
              "lt": "now"
            }
          }
        },
        "no_match_query": "none"
      }
    },
    "aggs": {
      "per_host": {
        "terms": {
          "field": "beat.hostname.keyword",
          "size": 6000
        },
        "aggs": {
          "per_file": {
            "terms": {
              "field": "source.keyword",
              "size": 6000
            },
            "aggs": {
              "per_minute": {
                "date_histogram": {
                  "field": "@timestamp",
                  "interval": "minute"
                }
              }
            }
          }
        }
      }
    }
  }
}