I am learning Lucene and Elasticsearch DSL.
I am using Winlogbeat and querying over field "log.level".
How to use aggregation "Count" and group the data by host so i know the count for a specific host.
Without using Visualization, i am fetching the count of events for 6 hours see below:
I get the following results:
But there are multiple servers/hosts how can i get the following output:
Count 27 Host: XYZ_SERVER
Count 14 Host: ABC_SERVER
Count 20 Host: FGH_SERVER
I may have to use aggregation and group the data by host so i know the count for a specific host:
How can i get the "count" and group by "host.name"
I basically want to do something like this:
Select count(log.level=error) from Winlogbeat group by host