94 lines
2.2 KiB
Plaintext
94 lines
2.2 KiB
Plaintext
|
[[search-aggregations-bucket-iprange-aggregation]]
|
||
|
|
=== IPv4 Range
|
||
|
|
|
||
|
|
Just like the dedicated <<search-aggregations-bucket-daterange-aggregation,date>> range aggregation, there is also a dedicated range aggregation for IPv4 typed fields:
|
||
|
|
|
||
|
|
Example:
|
||
|
|
|
||
|
|
[source,js]
|
||
|
|
--------------------------------------------------
|
||
|
|
{
|
||
|
|
"aggs" : {
|
||
|
|
"ip_ranges" : {
|
||
|
|
"ip_range" : {
|
||
|
|
"field" : "ip",
|
||
|
|
"ranges" : [
|
||
|
|
{ "to" : "10.0.0.5" },
|
||
|
|
{ "from" : "10.0.0.5" }
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--------------------------------------------------
|
||
|
|
|
||
|
|
Response:
|
||
|
|
|
||
|
|
[source,js]
|
||
|
|
--------------------------------------------------
|
||
|
|
{
|
||
|
|
...
|
||
|
|
|
||
|
|
"aggregations": {
|
||
|
|
"ip_ranges": [
|
||
|
|
{
|
||
|
|
"to": 167772165,
|
||
|
|
"to_as_string": "10.0.0.5",
|
||
|
|
"doc_count": 4
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"from": 167772165,
|
||
|
|
"from_as_string": "10.0.0.5",
|
||
|
|
"doc_count": 6
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--------------------------------------------------
|
||
|
|
|
||
|
|
IP ranges can also be defined as CIDR masks:
|
||
|
|
|
||
|
|
[source,js]
|
||
|
|
--------------------------------------------------
|
||
|
|
{
|
||
|
|
"aggs" : {
|
||
|
|
"ip_ranges" : {
|
||
|
|
"ip_range" : {
|
||
|
|
"field" : "ip",
|
||
|
|
"ranges" : [
|
||
|
|
{ "mask" : "10.0.0.0/25" },
|
||
|
|
{ "mask" : "10.0.0.127/25" }
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--------------------------------------------------
|
||
|
|
|
||
|
|
Response:
|
||
|
|
|
||
|
|
[source,js]
|
||
|
|
--------------------------------------------------
|
||
|
|
{
|
||
|
|
"aggregations": {
|
||
|
|
"ip_ranges": [
|
||
|
|
{
|
||
|
|
"key": "10.0.0.0/25",
|
||
|
|
"from": 1.6777216E+8,
|
||
|
|
"from_as_string": "10.0.0.0",
|
||
|
|
"to": 167772287,
|
||
|
|
"to_as_string": "10.0.0.127",
|
||
|
|
"doc_count": 127
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"key": "10.0.0.127/25",
|
||
|
|
"from": 1.6777216E+8,
|
||
|
|
"from_as_string": "10.0.0.0",
|
||
|
|
"to": 167772287,
|
||
|
|
"to_as_string": "10.0.0.127",
|
||
|
|
"doc_count": 127
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--------------------------------------------------
|