204 lines
4.9 KiB
Plaintext
204 lines
4.9 KiB
Plaintext
[[search-aggregations-bucket-iprange-aggregation]]
|
|
=== IP Range Aggregation
|
|
|
|
Just like the dedicated <<search-aggregations-bucket-daterange-aggregation,date>> range aggregation, there is also a dedicated range aggregation for IP typed fields:
|
|
|
|
Example:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /ip_addresses/data/_search
|
|
{
|
|
"size": 10,
|
|
"aggs" : {
|
|
"ip_ranges" : {
|
|
"ip_range" : {
|
|
"field" : "ip",
|
|
"ranges" : [
|
|
{ "to" : "10.0.0.5" },
|
|
{ "from" : "10.0.0.5" }
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[setup:iprange]
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...
|
|
|
|
"aggregations": {
|
|
"ip_ranges": {
|
|
"buckets" : [
|
|
{
|
|
"to": "10.0.0.5",
|
|
"doc_count": 10
|
|
},
|
|
{
|
|
"from": "10.0.0.5",
|
|
"doc_count": 260
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
|
|
|
|
IP ranges can also be defined as CIDR masks:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /ip_addresses/data/_search
|
|
{
|
|
"size": 0,
|
|
"aggs" : {
|
|
"ip_ranges" : {
|
|
"ip_range" : {
|
|
"field" : "ip",
|
|
"ranges" : [
|
|
{ "mask" : "10.0.0.0/25" },
|
|
{ "mask" : "10.0.0.127/25" }
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[setup:iprange]
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...
|
|
|
|
"aggregations": {
|
|
"ip_ranges": {
|
|
"buckets": [
|
|
{
|
|
"key": "10.0.0.0/25",
|
|
"from": "10.0.0.0",
|
|
"to": "10.0.0.128",
|
|
"doc_count": 128
|
|
},
|
|
{
|
|
"key": "10.0.0.127/25",
|
|
"from": "10.0.0.0",
|
|
"to": "10.0.0.128",
|
|
"doc_count": 128
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
|
|
|
|
==== Keyed Response
|
|
|
|
Setting the `keyed` flag to `true` will associate a unique string key with each bucket and return the ranges as a hash rather than an array:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /ip_addresses/data/_search
|
|
{
|
|
"size": 0,
|
|
"aggs": {
|
|
"ip_ranges": {
|
|
"ip_range": {
|
|
"field": "ip",
|
|
"ranges": [
|
|
{ "to" : "10.0.0.5" },
|
|
{ "from" : "10.0.0.5" }
|
|
],
|
|
"keyed": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[setup:iprange]
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...
|
|
|
|
"aggregations": {
|
|
"ip_ranges": {
|
|
"buckets": {
|
|
"*-10.0.0.5": {
|
|
"to": "10.0.0.5",
|
|
"doc_count": 10
|
|
},
|
|
"10.0.0.5-*": {
|
|
"from": "10.0.0.5",
|
|
"doc_count": 260
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/]
|
|
|
|
It is also possible to customize the key for each range:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET /ip_addresses/data/_search
|
|
{
|
|
"size": 0,
|
|
"aggs": {
|
|
"ip_ranges": {
|
|
"ip_range": {
|
|
"field": "ip",
|
|
"ranges": [
|
|
{ "key": "infinity", "to" : "10.0.0.5" },
|
|
{ "key": "and-beyond", "from" : "10.0.0.5" }
|
|
],
|
|
"keyed": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[setup:iprange]
|
|
|
|
Response:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
{
|
|
...
|
|
|
|
"aggregations": {
|
|
"ip_ranges": {
|
|
"buckets": {
|
|
"infinity": {
|
|
"to": "10.0.0.5",
|
|
"doc_count": 10
|
|
},
|
|
"and-beyond": {
|
|
"from": "10.0.0.5",
|
|
"doc_count": 260
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TESTRESPONSE[s/\.\.\./"took": $body.took,"timed_out": false,"_shards": $body._shards,"hits": $body.hits,/] |