IP範囲（IP range）

IP範囲の集約

専用の date 範囲集約と同様に、IP型フィールド用の専用範囲集約もあります：

例：

Python

resp = client.search(
   index="ip_addresses",
   size=10,
   aggs={
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   {
   "to": "10.0.0.5"
   },
   {
   "from": "10.0.0.5"
   }
   ]
   }
   }
   },
)
print(resp)

Ruby

response = client.search(
  index: 'ip_addresses',
  body: {
   size: 10,
   aggregations: {
   ip_ranges: {
   ip_range: {
   field: 'ip',
   ranges: [
   {
   to: '10.0.0.5'
   },
   {
   from: '10.0.0.5'
   }
   ]
   }
   }
   }
  }
)
puts response

Js

const response = await client.search({
  index: "ip_addresses",
  size: 10,
  aggs: {
   ip_ranges: {
   ip_range: {
   field: "ip",
   ranges: [
   {
   to: "10.0.0.5",
   },
   {
   from: "10.0.0.5",
   },
   ],
   },
   },
  },
});
console.log(response);

コンソール

GET /ip_addresses/_search
{
  "size": 10,
  "aggs": {
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   { "to": "10.0.0.5" },
   { "from": "10.0.0.5" }
   ]
   }
   }
  }
}

応答：

コンソール結果

{
  ...
  "aggregations": {
   "ip_ranges": {
   "buckets": [
   {
   "key": "*-10.0.0.5",
   "to": "10.0.0.5",
   "doc_count": 10
   },
   {
   "key": "10.0.0.5-*",
   "from": "10.0.0.5",
   "doc_count": 260
   }
   ]
   }
  }
}

IP範囲はCIDRマスクとしても定義できます：

Python

resp = client.search(
   index="ip_addresses",
   size=0,
   aggs={
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   {
   "mask": "10.0.0.0/25"
   },
   {
   "mask": "10.0.0.127/25"
   }
   ]
   }
   }
   },
)
print(resp)

Ruby

response = client.search(
  index: 'ip_addresses',
  body: {
   size: 0,
   aggregations: {
   ip_ranges: {
   ip_range: {
   field: 'ip',
   ranges: [
   {
   mask: '10.0.0.0/25'
   },
   {
   mask: '10.0.0.127/25'
   }
   ]
   }
   }
   }
  }
)
puts response

Js

const response = await client.search({
  index: "ip_addresses",
  size: 0,
  aggs: {
   ip_ranges: {
   ip_range: {
   field: "ip",
   ranges: [
   {
   mask: "10.0.0.0/25",
   },
   {
   mask: "10.0.0.127/25",
   },
   ],
   },
   },
  },
});
console.log(response);

コンソール

GET /ip_addresses/_search
{
  "size": 0,
  "aggs": {
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   { "mask": "10.0.0.0/25" },
   { "mask": "10.0.0.127/25" }
   ]
   }
   }
  }
}

応答：

コンソール結果

{
  ...
  "aggregations": {
   "ip_ranges": {
   "buckets": [
   {
   "key": "10.0.0.0/25",
   "from": "10.0.0.0",
   "to": "10.0.0.128",
   "doc_count": 128
   },
   {
   "key": "10.0.0.127/25",
   "from": "10.0.0.0",
   "to": "10.0.0.128",
   "doc_count": 128
   }
   ]
   }
  }
}

キー付き応答

keyed フラグを true に設定すると、各バケットに一意の文字列キーが関連付けられ、範囲が配列ではなくハッシュとして返されます：

Python

resp = client.search(
   index="ip_addresses",
   size=0,
   aggs={
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   {
   "to": "10.0.0.5"
   },
   {
   "from": "10.0.0.5"
   }
   ],
   "keyed": True
   }
   }
   },
)
print(resp)

Ruby

response = client.search(
  index: 'ip_addresses',
  body: {
   size: 0,
   aggregations: {
   ip_ranges: {
   ip_range: {
   field: 'ip',
   ranges: [
   {
   to: '10.0.0.5'
   },
   {
   from: '10.0.0.5'
   }
   ],
   keyed: true
   }
   }
   }
  }
)
puts response

Js

const response = await client.search({
  index: "ip_addresses",
  size: 0,
  aggs: {
   ip_ranges: {
   ip_range: {
   field: "ip",
   ranges: [
   {
   to: "10.0.0.5",
   },
   {
   from: "10.0.0.5",
   },
   ],
   keyed: true,
   },
   },
  },
});
console.log(response);

コンソール

GET /ip_addresses/_search
{
  "size": 0,
  "aggs": {
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   { "to": "10.0.0.5" },
   { "from": "10.0.0.5" }
   ],
   "keyed": true
   }
   }
  }
}

応答：

コンソール結果

{
  ...
  "aggregations": {
   "ip_ranges": {
   "buckets": {
   "*-10.0.0.5": {
   "to": "10.0.0.5",
   "doc_count": 10
   },
   "10.0.0.5-*": {
   "from": "10.0.0.5",
   "doc_count": 260
   }
   }
   }
  }
}

各範囲のキーをカスタマイズすることも可能です：

Python

resp = client.search(
   index="ip_addresses",
   size=0,
   aggs={
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   {
   "key": "infinity",
   "to": "10.0.0.5"
   },
   {
   "key": "and-beyond",
   "from": "10.0.0.5"
   }
   ],
   "keyed": True
   }
   }
   },
)
print(resp)

Ruby

response = client.search(
  index: 'ip_addresses',
  body: {
   size: 0,
   aggregations: {
   ip_ranges: {
   ip_range: {
   field: 'ip',
   ranges: [
   {
   key: 'infinity',
   to: '10.0.0.5'
   },
   {
   key: 'and-beyond',
   from: '10.0.0.5'
   }
   ],
   keyed: true
   }
   }
   }
  }
)
puts response

Js

const response = await client.search({
  index: "ip_addresses",
  size: 0,
  aggs: {
   ip_ranges: {
   ip_range: {
   field: "ip",
   ranges: [
   {
   key: "infinity",
   to: "10.0.0.5",
   },
   {
   key: "and-beyond",
   from: "10.0.0.5",
   },
   ],
   keyed: true,
   },
   },
  },
});
console.log(response);

コンソール

GET /ip_addresses/_search
{
  "size": 0,
  "aggs": {
   "ip_ranges": {
   "ip_range": {
   "field": "ip",
   "ranges": [
   { "key": "infinity", "to": "10.0.0.5" },
   { "key": "and-beyond", "from": "10.0.0.5" }
   ],
   "keyed": true
   }
   }
  }
}

応答：

コンソール結果

{
  ...
  "aggregations": {
   "ip_ranges": {
   "buckets": {
   "infinity": {
   "to": "10.0.0.5",
   "doc_count": 10
   },
   "and-beyond": {
   "from": "10.0.0.5",
   "doc_count": 260
   }
   }
   }
  }
}