How can I filter for a specific field value in this query?

Elastic Stack Elasticsearch
1

Hi,

I made this query and it gives me the results I'm looking for however I want to get the SUM where field wan_int matches wan1 (I got multiple wan interfaces). I tried adding filters and a query but I can't get it to work.

{
 "size":"0",
    "aggs": {
        "range": {
            "date_range": {
                "field": "@timestamp",
                "format": "YYYY/MM/DD, HH:mm:ss",
                "ranges": [
                    { "from": "now/1M" } 
                ]
            },
    "aggs" : {
        "switch_location" : {
            "terms" : {
                "field" : "location"
            },
            "aggs" : {
            "total_bytes": {
            "sum": {
            "script" : "doc['in_bytes'].value + doc['out_bytes'].value"
         }
       }
      }
     }
    }
   }
 }
}
2 
{
 "size":"0",
	"query": {
		"bool": {
			"filter": {
				"match": {
					"wan_int": "wan1"
				}
			}
		}
	},
    "aggs": {
        "range": {
            "date_range": {
                "field": "@timestamp",
                "format": "YYYY/MM/DD, HH:mm:ss",
                "ranges": [
                    { "from": "now/1M" } 
                ]
            },
    "aggs" : {
        "switch_location" : {
            "terms" : {
                "field" : "location"
            },
            "aggs" : {
            "total_bytes": {
            "sum": {
            "script" : "doc['in_bytes'].value + doc['out_bytes'].value"
         }
       }
      }
     }
    }
   }
 }
}
1 Like
3

Thanks, that works.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.