I am not able to print more than 10 (which i think is default) output using below query
{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-security-*"
],
"types": [],
"body": {
"aggs": {
"indicator": {
"terms": {
"field": "indicator.keyword",
"order": {
"_count": "desc"
}
}
}
}
}
}
}
}
},
{
"second": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-checkpoint-*"
],
"types": [],
"body": {
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "dstip:{{#ctx.payload.first.aggregations.indicator.buckets}}{{key}} {{/ctx.payload.first.aggregations.indicator.buckets}}"
}
},
{
"range": {
"@timestamp": {
"gte": "now-7d"
}
}
}
]
}
}
}
}
}
}
}
]
}
},
"condition": {
"compare": {
"ctx.payload.second.hits.total": {
"gt": 0
}
}
},
"actions": {
"log": {
"logging": {
"level": "info",
"text": "Test"
}
},
"send_mail": {
"email": {
"profile": "standard",
"to": [
"addanuj@gmail.com"
],
"subject": "DEVTools test Internal connections to known malware IPs",
"body": {
"html": "<table border='2'><tr><th>ThreatIntel IP</th><th>count</th></tr><tr>{{#ctx.payload.first.aggregations.indicator.buckets}}<td>{{key}}</td><td>{{doc_count}}</td></tr><tr>{{/ctx.payload.first.aggregations.indicator.buckets}}</tr></table>"
}
}
}
}
}