How convert this SQL query to Elasticsearch query?

Elastic Stack Elasticsearch
1

Hello!

I have this SQL query:

SELECT time,targetuser, count(targetuser),ipaddress FROM `test_index` WHERE `event_id`=4444 AND `status`=`0x10`  GROUP BY ipaddress,targetuser ORDER BY TIME DESC;

How convert this SQL query to Elasticsearch query? is it possible?

2

You probably need to do a terms agg on ipaddress and then another inner one on targetuser and a bool query with 2 term clauses (one on event_id with a value of 4444, and another one on status with a value of "0x10") that you would put inside the must array of the bool query.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.