Hello,
I have data in ES such as:
@timestamp --> Timestamp field
record.hostIP
record.destIP
record.port
record.application
etc...
I would like to plot this on a graph in js and hence need time on the X axis and count of record.<> on the Y axis.
This query gets me docs sorted by timestamp vs count (of all documents).
What do I want to do if I need count of record.application in the last 1 hour, sorted by timestamp from earliest to latest?
GET _search
{
"size": "0",
"aggs": {
"oneHourTimeRange": {
"filter": {
"range": {
"@timestamp": {
"gte": "now-60m",
"lte": "now"
}
}
},
"aggs": {
"totalTraffic": {
"terms": {
"field": "@timestamp",
"size": 500,
"order": { "_key": "asc" }
}
}
}
}
}
}