# Fetch list of agent epheremal ID java API **URL:** \ **Category:** APM\ **Tags:** java, language-clients\ **Created:** [January 9, 2023, 11:05am UTC](https://discuss.elastic.co/t/fetch-list-of-agent-epheremal-id-java-api/322723 "2023-01-09T11:05:58Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Namita\_Jaokar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/namita_jaokar/32/104106_2.png) [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Post date:** [January 9, 2023, 11:05am UTC](https://discuss.elastic.co/t/fetch-list-of-agent-epheremal-id-java-api/322723/1 "2023-01-09T11:05:58Z")
Hi Team, I want to fetch list of agent ephemeral Id's integrated for a particular agent along with the client ip and process.pid. For the same, I have implemented the EQL using aggregations which gives me the output as expected. But in case of EQL's java implementation , It gives me entire list of emphermal ID irrespective of it being within the timestamp range. Adding the snippet of both EQL and its java implementation EQL ```auto GET traces-apm*,metrics-apm*/_search { "size": 0, "fields": [ "service.name", "@timestamp" ], "query": { "bool": { "filter": [ { "range": { "@timestamp": { "gte": "now-1h", "lte": "now" } }},{ "bool":{ "must":[ { "term":{ "service.name" : "my_service_name" } } ] } } ] } }, "_source": false, "aggs": { "service_name": { "terms": { "field": "service.name", "size": 100 }, "aggs": { "agent_ephemeral_id": { "terms": { "field": "agent.ephemeral_id" }, "aggs":{ "client_ip" :{ "terms" :{ "field" :"client.ip" } },"process_pid" : { "terms" :{ "field" : "process.pid" } } } } } } } } ``` Java Implementation of above EQL query. ```auto List eqlQueryagentEphermalIdList=new ArrayList<>(); try (RestHighLevelClient client = new RestHighLevelClient(builder)) { SearchRequest searchRequest = new SearchRequest("traces-apm*,metrics-apm*"); SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder().fetchSource(false) .fetchField("service.name").fetchField("@timestamp"); searchSourceBuilder .query(QueryBuilders.boolQuery() .filter(QueryBuilders.rangeQuery("@timestamp").gte("now-1h").lt("now"))) .query(QueryBuilders.boolQuery().must(QueryBuilders.termQuery("service.name", agentName))) .aggregation(AggregationBuilders.terms("service_name").field("service.name") .subAggregation(AggregationBuilders.terms("agent_ephemeral_id").field("agent.ephemeral_id").size(1000) .subAggregation(AggregationBuilders.terms("client_ip").field("client.ip").size(1000))) .subAggregation(AggregationBuilders.terms("process_pid").field("process.pid").size(1000))); searchRequest.source(searchSourceBuilder); SearchResponse searchResponse = client.search(searchRequest, RequestOptions.DEFAULT); Terms terms = searchResponse.getAggregations().get("service_name"); for(Terms.Bucket bucket : terms.getBuckets()) { System.out.println("bucket======"+bucket.getAggregations().toString()); Terms sub_terms=bucket.getAggregations().get("agent_ephemeral_id"); for(Terms.Bucket termsBucket : sub_terms.getBuckets()) { System.out.println("bucket Aggregation======"+termsBucket.getKeyAsString() ); eqlQueryagentEphermalIdList.add(termsBucket.getKeyAsString()); } } List eqlQueryagentEphermalIdList=new ArrayList<>(); try (RestHighLevelClient client = new RestHighLevelClient(builder)) { SearchRequest searchRequest = new SearchRequest("traces-apm*,metrics-apm*"); SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder().fetchSource(false) .fetchField("service.name").fetchField("@timestamp"); searchSourceBuilder .query(QueryBuilders.boolQuery() .filter(QueryBuilders.rangeQuery("@timestamp").gte("now-1h").lt("now"))) .query(QueryBuilders.boolQuery().must(QueryBuilders.termQuery("service.name", agentName))) .aggregation(AggregationBuilders.terms("service_name").field("service.name") .subAggregation(AggregationBuilders.terms("agent_ephemeral_id").field("agent.ephemeral_id").size(1000) .subAggregation(AggregationBuilders.terms("client_ip").field("client.ip").size(1000))) .subAggregation(AggregationBuilders.terms("process_pid").field("process.pid").size(1000))); searchRequest.source(searchSourceBuilder); SearchResponse searchResponse = client.search(searchRequest, RequestOptions.DEFAULT); Terms terms = searchResponse.getAggregations().get("service_name"); for(Terms.Bucket bucket : terms.getBuckets()) { System.out.println("bucket======"+bucket.getAggregations().toString()); Terms sub_terms=bucket.getAggregations().get("agent_ephemeral_id"); for(Terms.Bucket termsBucket : sub_terms.getBuckets()) { System.out.println("bucket Aggregation======"+termsBucket.getKeyAsString() ); eqlQueryagentEphermalIdList.add(termsBucket.getKeyAsString()); } } ``` Can someone please advise in what has to be corrected in the java implementation of the EQL. I tried providing size to the sub aggregations but that did not work. Thanks & Regards, Namita ---
**Author:** ![Jack\_Shirazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_shirazi/32/91641_2.png) [@Jack\_Shirazi](https://discuss.elastic.co/u/Jack_Shirazi)\ **Post date:** [January 11, 2023, 3:25pm UTC](https://discuss.elastic.co/t/fetch-list-of-agent-epheremal-id-java-api/322723/2 "2023-01-11T15:25:15Z")
Hi, this section of the forum is more about things related to using the APM java agent rather than using the elasticsearch client. I think you want to ask on the [elasticsearch](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6) side of the forum? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 1, 2023, 11:25am UTC](https://discuss.elastic.co/t/fetch-list-of-agent-epheremal-id-java-api/322723/3 "2023-02-01T11:25:37Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.