I want to receive the last part of the response but the response a receive is this:
{
"took" : 264,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 2633168,
"max_score" : 1.0,
"hits" : [
{
"_index" : "imsva_message",
"_type" : "doc",
"_id" : "WfVs_WoBSNE1aGLxrOE6",
"_score" : 1.0,
"_source" : {
"tags" : [
"imsva"
],
"id2" : "0EDCC2C35B",
"resposta_server" : "xxx x.x.x <1691604597.3.1559029876687@xxxx.xxx.xx> [InternalId=3079491607003, Hostname=CY1NAM02HT065.eop-nam02.prod.protection.outlook.com] 14094 bytes in 0.986, 13.951 KB/sec Queued mail for delivery -> 250 2.1.5",
"data5" : "2019 May 28 04:51:21 -03:00",
"destinatario" : "x",
"host" : "x",
"data3" : "2019 May 28 04:51:24 -03:00",
"host_origen" : "x",
"campo16" : "00100000000000000",
"anexo" : null,
"transacao" : " NormalTransac",
"campo22" : "3",
"host_destino" : "x",
"remetente" : "x",
"campo21" : null,
"id" : "57414824-89ED-EE05-BA8F-FBB4820494C8",
"assunto" : "x",
"campo5" : "x",
"campo17" : "0",
"type" : "syslog",
"data1" : "2019-05-28T07:51:21.000Z",
"data2" : "2019/05/28 04:51:21 -03:00",
"message_direction" : "outgoing",
"campo8" : "2",
"@version" : "1",
"status" : "sent",
"campo18" : null,
"data4" : "2019 May 28 04:51:21 -03:00",
"@timestamp" : "2019-05-28T07:51:58.675Z"
}
},
...
,
"aggregations" : {
"aggremetente" : {
"doc_count" : 268,
"teste1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 81,
"buckets" : [
{
"key" : "texte1@tjsc.jus.br",
"doc_count" : 110
},
{
"key" : "texte2@tjsc.jus.br",
"doc_count" : 24
},
{
"key" : "texte3@tjsc.jus.br",
"doc_count" : 18
},
{
"key" : "texte4@tjsc.jus.br",
"doc_count" : 11
},
{
"key" : "texte5@tjsc.jus.br",
"doc_count" : 7
},
{
"key" : "texte6@tjsc.jus.br",
"doc_count" : 4
},
{
"key" : "texte7@tjsc.jus.br",
"doc_count" : 4
},
{
"key" : "texte8@tjsc.jus.br",
"doc_count" : 3
},
{
"key" : "texte9@tjsc.jus.br",
"doc_count" : 3
},
{
"key" : "texte10@tjsc.jus.br",
"doc_count" : 3
}
]
}
}
}
}
I want to receive only this part:
"aggregations" : {
"aggremetente" : {
"doc_count" : 268,
"teste1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 81,
"buckets" : [
{
"key" : "texte1@tjsc.jus.br",
"doc_count" : 110
},
{
"key" : "texte2@tjsc.jus.br",
"doc_count" : 24
},
{
"key" : "texte3@tjsc.jus.br",
"doc_count" : 18
},
{
"key" : "texte4@tjsc.jus.br",
"doc_count" : 11
},
{
"key" : "texte5@tjsc.jus.br",
"doc_count" : 7
},
{
"key" : "texte6@tjsc.jus.br",
"doc_count" : 4
},
{
"key" : "texte7@tjsc.jus.br",
"doc_count" : 4
},
{
"key" : "texte8@tjsc.jus.br",
"doc_count" : 3
},
{
"key" : "texte9@tjsc.jus.br",
"doc_count" : 3
},
{
"key" : "texte10@tjsc.jus.br",
"doc_count" : 3
}
]
}
}
}
and this is the get :
GET /imsva_message/_search
{
"aggs" : {
"aggremetente" : {
"filter": {
"range": {
"data1": {
"from": "now-5m",
"to": "now"
}
}
},
"aggs" : {
"teste1" : {
"terms" : {
"field" : "remetente.keyword"
}
}
}
}
}
}