I am trying to merge multiple documents together if they contain the same src IP Address within the last 10 minutes.
The situation is zscaler sends us multiple document ( per request ) for each blocked botnet request
I have so far 2 seperate queries : last 5 minutes and top hit for SRC field. Am i on the right track and how do i combine it .
GET zscaler-*/_search
{
"size": 0,
"aggs": {
"by_id": {
"terms": {
"field": "src",
"min_doc_count": 2
},
"aggs": {
"same_ids": {
"top_hits": {
"size": 100
}
}
}
}
}
}
GET zscaler-*/_search
{
"query": {
"range" : {
"msgSubmissionTime" : {
"gte" : "now-5m",
"lt" : "now"
}
}
}
}