Problems with aggregation query

Elastic Stack Elasticsearch
1

I'm having a difficult time trying to get what is a simple SQL query to
work with Elasticsearch. I can query, I can get counts, but can't seem to
get the aggregation to work.

For a simple SQL query: select source_ip, count(*) from my_table where
destination port='23' group by source_ip;

I've spent the day looking over documentation and examples, but just about
all of the examples I have seen don't seem to utilize a filter and
aggregate the entire index.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/d049ac60-cb1e-4d66-9e94-8b8f9093b9c2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Assuming the source_ip field is unanalyzed, your query could be something
like this:

{
'query': {
'terms': {
'port': [ 23 ]
}
},
'size': 0,
'aggs': {
'counts_per_ip': {
'terms': {
'field': 'source_ip'
}
}
}
}

On Saturday, February 14, 2015 at 2:40:17 AM UTC+1, Ian Hayes wrote:

I'm having a difficult time trying to get what is a simple SQL query to
work with Elasticsearch. I can query, I can get counts, but can't seem to
get the aggregation to work.

For a simple SQL query: select source_ip, count(*) from my_table where
destination port='23' group by source_ip;

I've spent the day looking over documentation and examples, but just about
all of the examples I have seen don't seem to utilize a filter and
aggregate the entire index.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/a51a023a-c4e5-4e69-b26e-427ccba748c1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.