[过滤器] 下应有 [START_OBJECT]

Question

我想在 aggs 中放置双重过滤器。像这样。

"aggs": {
  "download1" : {
        "filter" : [
            { "term": { "IPV4_DST_ADDR":"192.168.0.159"}},
            { "range": { "LAST_SWITCHED": { "gte": "now-5m" } }}
        ],
        "aggs" : {
            "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
        }
    }
}

但它显示了一个错误：

"error": {
"root_cause": [
  {
    "type": "parsing_exception",
    "reason": "Expected [START_OBJECT] under [filter], but got a [START_ARRAY] in [download1]",
    "line": 33,
    "col": 24
  }
]}

我该怎么办，先谢谢你了！

Answer 1

您需要将两个查询与bool/filter

{
  "aggs": {
    "download1": {
      "filter": {
        "bool": {
          "filter": [
            {
              "term": {
                "IPV4_DST_ADDR": "192.168.0.159"
              }
            },
            {
              "range": {
                "LAST_SWITCHED": {
                  "gte": "now-5m"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "downlod_bytes": {
          "sum": {
            "field": "IN_BYTES"
          }
        }
      }
    }
  }
}