elk

[asu126]

http://javaarm.com/file/opensource/www.elastic.co/kibana-guide-cn_rao.chenlin.pdf

[asu126]

{
    "size": 0,
    "query": {
        "bool": {
            "filter": {
                "range": {
                    "@timestamp": {
                        "gte": "2018-02-25",
                        "lte": "2018-02-25"
                    }
                }
            },
            "must": {
                "exists": {
                    "field": "project_name"
                }
            }
        }
    },
    "aggs": {
        "group_by_ip_and_project":{
            "terms":{
                "field":"remote_addr",
                "size" : 0
            },
            "aggs":{
                "project_name": { 
                    "terms": { 
                        "field": "project_name",
                        "size" : 0
                    },
                    "aggs":{
                        "p_body_bytes_sent":{
                            "sum":{
                                "field":"body_bytes_sent"
                            }
                        }
                    }
                }
            }
        }
    }
}