How to make a query for group by count?

Elastic Stack Elasticsearch
1

Hello!
I looking for information by event_id 2771

And i get result table (example):
image

I want to group the data and hide the duplicate TargetUser by their count in table. I want this result:
image

Is it possible?
How to make a query for group by count?

Thank you advance

2

You can try sub-aggregation:

 {

      "aggs": {

        "event_id": {

          "terms": {

            "field": "event_id"

          },

          "aggs": {

            "targetUser": {

              "terms": {

                "field": "tragetUser"

              },

              "aggs": {

                "ipAddress": {

                  "terms": {

                    "field": "ipAddress"

                  }

                }

              }

            }

          }

        }

      }

    }
3

Thank you. But how i can get column Count with count of TargetUser?

2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.