Search for last 24 hours logs based on field?

[Blason (R)]

Hey Folks,

Can someone please help me on constructing curl based query on src_ip and agg: those for last 24 hours?

here is something I constructed based on count and need help with for timerange

curl -s -XGET "https://127.0.0.1:9200/lox-*/_search" -H 'Content-Type: application/json' -d'
{
  "aggs": {
    "ips": {
      "terms": { "field": "src_ip.keyword", "size": 1000 }
      }
    },
  "size" : 0
  }'
}

[Blason (R)]

may be this I tried but not sure how do I agg:src_ip for last 24 hrs.

curl -XGET 'https://127.0.01:9200/lox-*/_search?pretty' -H 'Content-Type: application/json' -d'
{
    "query": {
        "range" : {
            "msgSubmissionTime" : {
                "gte" : "now-24h",
                "lt" :  "now"
            }
        }
    }
}
```