Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@vgersh99

vgersh99/searchWithAggs.json

Created July 20, 2018 19:33
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save vgersh99/05c30b80c6c9c69fd002286bf57245f6 to your computer and use it in GitHub Desktop.
Save vgersh99/05c30b80c6c9c69fd002286bf57245f6 to your computer and use it in GitHub Desktop.
Download ZIP
searchWithAggs.json
Raw
searchWithAggs.json
GET metrics/logs/_search?filter_path=aggregations.minutes.buckets.key,aggregations.minutes.buckets.nodes.buckets.key,aggregations.minutes.buckets.nodes.buckets.dir.buckets.key,aggregations.minutes.buckets.nodes.buckets.dir.buckets.eventCnt.value
{
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "role.keyword:idb-syslog-to-elk && hostname:idb-syslog-to-elk01",
"use_dis_max": true,
"analyze_wildcard": true
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"from": "now-15m",
"to": "now",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
}
],
"disable_coord": false,
"adjust_pure_negative": true,
"boost": 1
}
},
"aggregations": {
"minutes": {
"date_histogram": {
"field": "@timestamp",
"interval": "minute",
"offset": 0,
"order": {
"_key": "asc"
},
"keyed": false,
"min_doc_count": 0
},
"aggregations": {
"nodes": {
"terms": {
"field": "hostname.keyword",
"size": 10,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false
},
"aggregations": {
"dir": {
"terms": {
"field": "direction",
"size": 10,
"min_doc_count": 1,
"shard_min_doc_count": 0,
"show_term_doc_count_error": false
},
"aggregations": {
"eventCnt": {
"sum": {
"field": "events.count"
}
}
}
}
}
}
}
}
}
}
Raw
searchWithAggs.out
{
"aggregations": {
"minutes": {
"buckets": [
{
"key": 1532113800000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 137238834991
}
},
{
"key": "out",
"eventCnt": {
"value": 137238834991
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 140032464065
}
},
{
"key": "out",
"eventCnt": {
"value": 140032464065
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 163599760959
}
},
{
"key": "out",
"eventCnt": {
"value": 163599760959
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 151236874840
}
},
{
"key": "out",
"eventCnt": {
"value": 151236874840
}
}
]
}
}
]
}
},
{
"key": 1532113860000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477672221
}
},
{
"key": "out",
"eventCnt": {
"value": 274477672221
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064930170
}
},
{
"key": "out",
"eventCnt": {
"value": 280064930170
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199524216
}
},
{
"key": "out",
"eventCnt": {
"value": 327199524216
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473751950
}
},
{
"key": "out",
"eventCnt": {
"value": 302473751950
}
}
]
}
}
]
}
},
{
"key": 1532113920000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477675839
}
},
{
"key": "out",
"eventCnt": {
"value": 274477675839
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064933774
}
},
{
"key": "out",
"eventCnt": {
"value": 280064933774
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199527894
}
},
{
"key": "out",
"eventCnt": {
"value": 327199527894
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473755573
}
},
{
"key": "out",
"eventCnt": {
"value": 302473755573
}
}
]
}
}
]
}
},
{
"key": 1532113980000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477678910
}
},
{
"key": "out",
"eventCnt": {
"value": 274477678910
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064936744
}
},
{
"key": "out",
"eventCnt": {
"value": 280064936744
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199530900
}
},
{
"key": "out",
"eventCnt": {
"value": 327199530900
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473758601
}
},
{
"key": "out",
"eventCnt": {
"value": 302473758601
}
}
]
}
}
]
}
},
{
"key": 1532114040000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477681768
}
},
{
"key": "out",
"eventCnt": {
"value": 274477681768
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064939894
}
},
{
"key": "out",
"eventCnt": {
"value": 280064939894
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199533824
}
},
{
"key": "out",
"eventCnt": {
"value": 327199533824
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473761537
}
},
{
"key": "out",
"eventCnt": {
"value": 302473761537
}
}
]
}
}
]
}
},
{
"key": 1532114100000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477684279
}
},
{
"key": "out",
"eventCnt": {
"value": 274477684279
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064942603
}
},
{
"key": "out",
"eventCnt": {
"value": 280064942603
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199536478
}
},
{
"key": "out",
"eventCnt": {
"value": 327199536478
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473764304
}
},
{
"key": "out",
"eventCnt": {
"value": 302473764304
}
}
]
}
}
]
}
},
{
"key": 1532114160000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477687672
}
},
{
"key": "out",
"eventCnt": {
"value": 274477687672
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064946021
}
},
{
"key": "out",
"eventCnt": {
"value": 280064946021
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199539950
}
},
{
"key": "out",
"eventCnt": {
"value": 327199539950
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473767634
}
},
{
"key": "out",
"eventCnt": {
"value": 302473767634
}
}
]
}
}
]
}
},
{
"key": 1532114220000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477690577
}
},
{
"key": "out",
"eventCnt": {
"value": 274477690577
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064948907
}
},
{
"key": "out",
"eventCnt": {
"value": 280064948907
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199542808
}
},
{
"key": "out",
"eventCnt": {
"value": 327199542808
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473770641
}
},
{
"key": "out",
"eventCnt": {
"value": 302473770641
}
}
]
}
}
]
}
},
{
"key": 1532114280000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477693624
}
},
{
"key": "out",
"eventCnt": {
"value": 274477693624
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064951791
}
},
{
"key": "out",
"eventCnt": {
"value": 280064951791
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199545879
}
},
{
"key": "out",
"eventCnt": {
"value": 327199545879
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473773606
}
},
{
"key": "out",
"eventCnt": {
"value": 302473773606
}
}
]
}
}
]
}
},
{
"key": 1532114340000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477696318
}
},
{
"key": "out",
"eventCnt": {
"value": 274477696318
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064954557
}
},
{
"key": "out",
"eventCnt": {
"value": 280064954557
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199548517
}
},
{
"key": "out",
"eventCnt": {
"value": 327199548517
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473776253
}
},
{
"key": "out",
"eventCnt": {
"value": 302473776253
}
}
]
}
}
]
}
},
{
"key": 1532114400000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274477713942
}
},
{
"key": "out",
"eventCnt": {
"value": 274477713942
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280064978767
}
},
{
"key": "out",
"eventCnt": {
"value": 280064978767
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327199571088
}
},
{
"key": "out",
"eventCnt": {
"value": 327199571088
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302473793641
}
},
{
"key": "out",
"eventCnt": {
"value": 302473793641
}
}
]
}
}
]
}
},
{
"key": 1532114460000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274478156902
}
},
{
"key": "out",
"eventCnt": {
"value": 274478156902
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280065438505
}
},
{
"key": "out",
"eventCnt": {
"value": 280065438505
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327200024953
}
},
{
"key": "out",
"eventCnt": {
"value": 327200024953
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302474234882
}
},
{
"key": "out",
"eventCnt": {
"value": 302474234882
}
}
]
}
}
]
}
},
{
"key": 1532114520000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274478549879
}
},
{
"key": "out",
"eventCnt": {
"value": 274478549879
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280065821386
}
},
{
"key": "out",
"eventCnt": {
"value": 280065821386
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327200411501
}
},
{
"key": "out",
"eventCnt": {
"value": 327200411501
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302474629064
}
},
{
"key": "out",
"eventCnt": {
"value": 302474629064
}
}
]
}
}
]
}
},
{
"key": 1532114580000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274478843654
}
},
{
"key": "out",
"eventCnt": {
"value": 274478843654
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280066113927
}
},
{
"key": "out",
"eventCnt": {
"value": 280066113927
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327200704291
}
},
{
"key": "out",
"eventCnt": {
"value": 327200704291
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302474923030
}
},
{
"key": "out",
"eventCnt": {
"value": 302474923030
}
}
]
}
}
]
}
},
{
"key": 1532114640000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 274479162510
}
},
{
"key": "out",
"eventCnt": {
"value": 274479162510
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 280066433185
}
},
{
"key": "out",
"eventCnt": {
"value": 280066433185
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 327201023836
}
},
{
"key": "out",
"eventCnt": {
"value": 327201023836
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 302475241458
}
},
{
"key": "out",
"eventCnt": {
"value": 302475241459
}
}
]
}
}
]
}
},
{
"key": 1532114700000,
"nodes": {
"buckets": [
{
"key": "idb-syslog-to-elk01",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 137239694114
}
},
{
"key": "out",
"eventCnt": {
"value": 137239694114
}
}
]
}
},
{
"key": "idb-syslog-to-elk03",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 163600624769
}
},
{
"key": "out",
"eventCnt": {
"value": 163600624769
}
}
]
}
},
{
"key": "idb-syslog-to-elk04",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 151237733688
}
},
{
"key": "out",
"eventCnt": {
"value": 151237733688
}
}
]
}
},
{
"key": "idb-syslog-to-elk02",
"dir": {
"buckets": [
{
"key": "in",
"eventCnt": {
"value": 116694436164
}
},
{
"key": "out",
"eventCnt": {
"value": 116694436165
}
}
]
}
}
]
}
}
]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment