IPプレフィックス集約

IPアドレスのネットワークまたはサブネットワークに基づいてドキュメントをグループ化するバケット集約です。IPアドレスは、ネットワークプレフィックスを表す最上位ビットと、ホストを表す最下位ビットの2つのビットグループで構成されています。

例

例えば、次のインデックスを考えてみてください:

Python

  1. resp = client.indices.create(
  2.    index="network-traffic",
  3.    mappings={
  4.    "properties": {
  5.    "ipv4": {
  6.    "type": "ip"
  7.    },
  8.    "ipv6": {
  9.    "type": "ip"
  10.    }
  11.    }
  12.    },
  13. )
  14. print(resp)
  16. resp1 = client.bulk(
  17.    index="network-traffic",
  18.    refresh=True,
  19.    operations=[
  20.    {
  21.    "index": {
  22.    "_id": 0
  23.    }
  24.    },
  25.    {
  26.    "ipv4": "192.168.1.10",
  27.    "ipv6": "2001:db8:a4f8:112a:6001:0:12:7f10"
  28.    },
  29.    {
  30.    "index": {
  31.    "_id": 1
  32.    }
  33.    },
  34.    {
  35.    "ipv4": "192.168.1.12",
  36.    "ipv6": "2001:db8:a4f8:112a:6001:0:12:7f12"
  37.    },
  38.    {
  39.    "index": {
  40.    "_id": 2
  41.    }
  42.    },
  43.    {
  44.    "ipv4": "192.168.1.33",
  45.    "ipv6": "2001:db8:a4f8:112a:6001:0:12:7f33"
  46.    },
  47.    {
  48.    "index": {
  49.    "_id": 3
  50.    }
  51.    },
  52.    {
  53.    "ipv4": "192.168.1.10",
  54.    "ipv6": "2001:db8:a4f8:112a:6001:0:12:7f10"
  55.    },
  56.    {
  57.    "index": {
  58.    "_id": 4
  59.    }
  60.    },
  61.    {
  62.    "ipv4": "192.168.2.41",
  63.    "ipv6": "2001:db8:a4f8:112c:6001:0:12:7f41"
  64.    },
  65.    {
  66.    "index": {
  67.    "_id": 5
  68.    }
  69.    },
  70.    {
  71.    "ipv4": "192.168.2.10",
  72.    "ipv6": "2001:db8:a4f8:112c:6001:0:12:7f10"
  73.    },
  74.    {
  75.    "index": {
  76.    "_id": 6
  77.    }
  78.    },
  79.    {
  80.    "ipv4": "192.168.2.23",
  81.    "ipv6": "2001:db8:a4f8:112c:6001:0:12:7f23"
  82.    },
  83.    {
  84.    "index": {
  85.    "_id": 7
  86.    }
  87.    },
  88.    {
  89.    "ipv4": "192.168.3.201",
  90.    "ipv6": "2001:db8:a4f8:114f:6001:0:12:7201"
  91.    },
  92.    {
  93.    "index": {
  94.    "_id": 8
  95.    }
  96.    },
  97.    {
  98.    "ipv4": "192.168.3.107",
  99.    "ipv6": "2001:db8:a4f8:114f:6001:0:12:7307"
  100.    }
  101.    ],
  102. )
  103. print(resp1)

Ruby

  1. response = client.indices.create(
  2.   index: 'network-traffic',
  3.   body: {
  4.    mappings: {
  5.    properties: {
  6.    "ipv4": {
  7.    type: 'ip'
  8.    },
  9.    "ipv6": {
  10.    type: 'ip'
  11.    }
  12.    }
  13.    }
  14.   }
  15. )
  16. puts response
  18. response = client.bulk(
  19.   index: 'network-traffic',
  20.   refresh: true,
  21.   body: [
  22.    {
  23.    index: {
  24.    _id: 0
  25.    }
  26.    },
  27.    {
  28.    "ipv4": '192.168.1.10',
  29.    "ipv6": '2001:db8:a4f8:112a:6001:0:12:7f10'
  30.    },
  31.    {
  32.    index: {
  33.    _id: 1
  34.    }
  35.    },
  36.    {
  37.    "ipv4": '192.168.1.12',
  38.    "ipv6": '2001:db8:a4f8:112a:6001:0:12:7f12'
  39.    },
  40.    {
  41.    index: {
  42.    _id: 2
  43.    }
  44.    },
  45.    {
  46.    "ipv4": '192.168.1.33',
  47.    "ipv6": '2001:db8:a4f8:112a:6001:0:12:7f33'
  48.    },
  49.    {
  50.    index: {
  51.    _id: 3
  52.    }
  53.    },
  54.    {
  55.    "ipv4": '192.168.1.10',
  56.    "ipv6": '2001:db8:a4f8:112a:6001:0:12:7f10'
  57.    },
  58.    {
  59.    index: {
  60.    _id: 4
  61.    }
  62.    },
  63.    {
  64.    "ipv4": '192.168.2.41',
  65.    "ipv6": '2001:db8:a4f8:112c:6001:0:12:7f41'
  66.    },
  67.    {
  68.    index: {
  69.    _id: 5
  70.    }
  71.    },
  72.    {
  73.    "ipv4": '192.168.2.10',
  74.    "ipv6": '2001:db8:a4f8:112c:6001:0:12:7f10'
  75.    },
  76.    {
  77.    index: {
  78.    _id: 6
  79.    }
  80.    },
  81.    {
  82.    "ipv4": '192.168.2.23',
  83.    "ipv6": '2001:db8:a4f8:112c:6001:0:12:7f23'
  84.    },
  85.    {
  86.    index: {
  87.    _id: 7
  88.    }
  89.    },
  90.    {
  91.    "ipv4": '192.168.3.201',
  92.    "ipv6": '2001:db8:a4f8:114f:6001:0:12:7201'
  93.    },
  94.    {
  95.    index: {
  96.    _id: 8
  97.    }
  98.    },
  99.    {
  100.    "ipv4": '192.168.3.107',
  101.    "ipv6": '2001:db8:a4f8:114f:6001:0:12:7307'
  102.    }
  103.   ]
  104. )
  105. puts response

Js

  1. const response = await client.indices.create({
  2.   index: "network-traffic",
  3.   mappings: {
  4.    properties: {
  5.    ipv4: {
  6.    type: "ip",
  7.    },
  8.    ipv6: {
  9.    type: "ip",
  10.    },
  11.    },
  12.   },
  13. });
  14. console.log(response);
  16. const response1 = await client.bulk({
  17.   index: "network-traffic",
  18.   refresh: "true",
  19.   operations: [
  20.    {
  21.    index: {
  22.    _id: 0,
  23.    },
  24.    },
  25.    {
  26.    ipv4: "192.168.1.10",
  27.    ipv6: "2001:db8:a4f8:112a:6001:0:12:7f10",
  28.    },
  29.    {
  30.    index: {
  31.    _id: 1,
  32.    },
  33.    },
  34.    {
  35.    ipv4: "192.168.1.12",
  36.    ipv6: "2001:db8:a4f8:112a:6001:0:12:7f12",
  37.    },
  38.    {
  39.    index: {
  40.    _id: 2,
  41.    },
  42.    },
  43.    {
  44.    ipv4: "192.168.1.33",
  45.    ipv6: "2001:db8:a4f8:112a:6001:0:12:7f33",
  46.    },
  47.    {
  48.    index: {
  49.    _id: 3,
  50.    },
  51.    },
  52.    {
  53.    ipv4: "192.168.1.10",
  54.    ipv6: "2001:db8:a4f8:112a:6001:0:12:7f10",
  55.    },
  56.    {
  57.    index: {
  58.    _id: 4,
  59.    },
  60.    },
  61.    {
  62.    ipv4: "192.168.2.41",
  63.    ipv6: "2001:db8:a4f8:112c:6001:0:12:7f41",
  64.    },
  65.    {
  66.    index: {
  67.    _id: 5,
  68.    },
  69.    },
  70.    {
  71.    ipv4: "192.168.2.10",
  72.    ipv6: "2001:db8:a4f8:112c:6001:0:12:7f10",
  73.    },
  74.    {
  75.    index: {
  76.    _id: 6,
  77.    },
  78.    },
  79.    {
  80.    ipv4: "192.168.2.23",
  81.    ipv6: "2001:db8:a4f8:112c:6001:0:12:7f23",
  82.    },
  83.    {
  84.    index: {
  85.    _id: 7,
  86.    },
  87.    },
  88.    {
  89.    ipv4: "192.168.3.201",
  90.    ipv6: "2001:db8:a4f8:114f:6001:0:12:7201",
  91.    },
  92.    {
  93.    index: {
  94.    _id: 8,
  95.    },
  96.    },
  97.    {
  98.    ipv4: "192.168.3.107",
  99.    ipv6: "2001:db8:a4f8:114f:6001:0:12:7307",
  100.    },
  101.   ],
  102. });
  103. console.log(response1);

コンソール

  1. PUT network-traffic
  2. {
  3.    "mappings": {
  4.    "properties": {
  5.    "ipv4": { "type": "ip" },
  6.    "ipv6": { "type": "ip" }
  7.    }
  8.    }
  9. }
  11. POST /network-traffic/_bulk?refresh
  12. {"index":{"_id":0}}
  13. {"ipv4":"192.168.1.10","ipv6":"2001:db8:a4f8:112a:6001:0:12:7f10"}
  14. {"index":{"_id":1}}
  15. {"ipv4":"192.168.1.12","ipv6":"2001:db8:a4f8:112a:6001:0:12:7f12"}
  16. {"index":{"_id":2}}
  17. { "ipv4":"192.168.1.33","ipv6":"2001:db8:a4f8:112a:6001:0:12:7f33"}
  18. {"index":{"_id":3}}
  19. {"ipv4":"192.168.1.10","ipv6":"2001:db8:a4f8:112a:6001:0:12:7f10"}
  20. {"index":{"_id":4}}
  21. {"ipv4":"192.168.2.41","ipv6":"2001:db8:a4f8:112c:6001:0:12:7f41"}
  22. {"index":{"_id":5}}
  23. {"ipv4":"192.168.2.10","ipv6":"2001:db8:a4f8:112c:6001:0:12:7f10"}
  24. {"index":{"_id":6}}
  25. {"ipv4":"192.168.2.23","ipv6":"2001:db8:a4f8:112c:6001:0:12:7f23"}
  26. {"index":{"_id":7}}
  27. {"ipv4":"192.168.3.201","ipv6":"2001:db8:a4f8:114f:6001:0:12:7201"}
  28. {"index":{"_id":8}}
  29. {"ipv4":"192.168.3.107","ipv6":"2001:db8:a4f8:114f:6001:0:12:7307"}

次の集約は、ドキュメントをバケットにグループ化します。各バケットは異なるサブネットワークを識別します。サブネットワークは、24のプレフィックス長を持つネットマスクを各IPアドレスに適用することによって計算されます。ipv4フィールド:

Python

  1. resp = client.search(
  2.    index="network-traffic",
  3.    size=0,
  4.    aggs={
  5.    "ipv4-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv4",
  8.    "prefix_length": 24
  9.    }
  10.    }
  11.    },
  12. )
  13. print(resp)

Ruby

  1. response = client.search(
  2.   index: 'network-traffic',
  3.   body: {
  4.    size: 0,
  5.    aggregations: {
  6.    "ipv4-subnets": {
  7.    ip_prefix: {
  8.    field: 'ipv4',
  9.    prefix_length: 24
  10.    }
  11.    }
  12.    }
  13.   }
  14. )
  15. puts response

Js

  1. const response = await client.search({
  2.   index: "network-traffic",
  3.   size: 0,
  4.   aggs: {
  5.    "ipv4-subnets": {
  6.    ip_prefix: {
  7.    field: "ipv4",
  8.    prefix_length: 24,
  9.    },
  10.    },
  11.   },
  12. });
  13. console.log(response);

コンソール

  1. GET /network-traffic/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.    "ipv4-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv4",
  8.    "prefix_length": 24
  9.    }
  10.    }
  11.   }
  12. }

応答:

コンソール-結果

  1. {
  2.   ...
  4.   "aggregations": {
  5.    "ipv4-subnets": {
  6.    "buckets": [
  7.    {
  8.    "key": "192.168.1.0",
  9.    "is_ipv6": false,
  10.    "doc_count": 4,
  11.    "prefix_length": 24,
  12.    "netmask": "255.255.255.0"
  13.    },
  14.    {
  15.    "key": "192.168.2.0",
  16.    "is_ipv6": false,
  17.    "doc_count": 3,
  18.    "prefix_length": 24,
  19.    "netmask": "255.255.255.0"
  20.    },
  21.    {
  22.    "key": "192.168.3.0",
  23.    "is_ipv6": false,
  24.    "doc_count": 2,
  25.    "prefix_length": 24,
  26.    "netmask": "255.255.255.0"
  27.    }
  28.    ]
  29.    }
  30.   }
  31. }

IPv6アドレスを集約するには、is_ipv6をtrueに設定します。

Python

  1. resp = client.search(
  2.    index="network-traffic",
  3.    size=0,
  4.    aggs={
  5.    "ipv6-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv6",
  8.    "prefix_length": 64,
  9.    "is_ipv6": True
  10.    }
  11.    }
  12.    },
  13. )
  14. print(resp)

Ruby

  1. response = client.search(
  2.   index: 'network-traffic',
  3.   body: {
  4.    size: 0,
  5.    aggregations: {
  6.    "ipv6-subnets": {
  7.    ip_prefix: {
  8.    field: 'ipv6',
  9.    prefix_length: 64,
  10.    "is_ipv6": true
  11.    }
  12.    }
  13.    }
  14.   }
  15. )
  16. puts response

Js

  1. const response = await client.search({
  2.   index: "network-traffic",
  3.   size: 0,
  4.   aggs: {
  5.    "ipv6-subnets": {
  6.    ip_prefix: {
  7.    field: "ipv6",
  8.    prefix_length: 64,
  9.    is_ipv6: true,
  10.    },
  11.    },
  12.   },
  13. });
  14. console.log(response);

コンソール

  1. GET /network-traffic/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.    "ipv6-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv6",
  8.    "prefix_length": 64,
  9.    "is_ipv6": true
  10.    }
  11.    }
  12.   }
  13. }
  1.  [](#6a16b05416d7fe2681cf39faf2eb47dd)
  4. #### コンソール-結果
  6. ``````console-result
  7. {
  8.   ...
  10.   "aggregations": {
  11.    "ipv6-subnets": {
  12.    "buckets": [
  13.    {
  14.    "key": "2001:db8:a4f8:112a::",
  15.    "is_ipv6": true,
  16.    "doc_count": 4,
  17.    "prefix_length": 64
  18.    },
  19.    {
  20.    "key": "2001:db8:a4f8:112c::",
  21.    "is_ipv6": true,
  22.    "doc_count": 3,
  23.    "prefix_length": 64
  24.    },
  25.    {
  26.    "key": "2001:db8:a4f8:114f::",
  27.    "is_ipv6": true,
  28.    "doc_count": 2,
  29.    "prefix_length": 64
  30.    }
  31.    ]
  32.    }
  33.   }
  34. }
  35. `

パラメータ

  • field
  • (必須、文字列) 集約するドキュメントのIPアドレスフィールド。フィールドマッピングタイプは ip でなければなりません。
  • prefix_length
  • (必須、整数) ネットワークプレフィックスの長さ。IPv4アドレスの場合、受け入れられる範囲は[0, 32]です。IPv6アドレスの場合、受け入れられる範囲は[0, 128]です。
  • is_ipv6
  • (オプション、ブール値) プレフィックスがIPv6アドレスに適用されるかどうかを定義します。prefix_lengthパラメータを指定するだけでは、IPプレフィックスがIPv4またはIPv6アドレスに適用されるかどうかを知るには不十分です。デフォルトはfalseです。
  • append_prefix_length
  • (オプション、ブール値) プレフィックス長が応答のIPアドレスキーに追加されるかどうかを定義します。デフォルトはfalseです。
  • keyed
  • (オプション、ブール値) バケットが応答で配列ではなくハッシュとして返されるかどうかを定義します。デフォルトはfalseです。
  • min_doc_count
  • (オプション、整数) 応答に含まれるバケットの最小ドキュメント数を定義します。デフォルトは1です。

応答ボディ

  • key
  • (文字列) IPv6またはIPv4サブネット。
  • prefix_length
  • (整数) バケットを集約するために使用されるプレフィックスの長さ。
  • doc_count
  • (整数) 特定のIPプレフィックスに一致するドキュメントの数。
  • is_ipv6
  • (ブール値) ネットマスクがIPv6ネットマスクであるかどうかを定義します。
  • netmask
  • (文字列) IPv4ネットマスク。is_ipv6がtrueの場合、このフィールドは応答に含まれません。

キー付き応答

  2. 例:
  5. #### Python
  7. ``````python
  8. resp = client.search(
  9.    index="network-traffic",
  10.    size=0,
  11.    aggs={
  12.    "ipv4-subnets": {
  13.    "ip_prefix": {
  14.    "field": "ipv4",
  15.    "prefix_length": 24,
  16.    "keyed": True
  17.    }
  18.    }
  19.    },
  20. )
  21. print(resp)
  22. `

Ruby

  1. response = client.search(
  2.   index: 'network-traffic',
  3.   body: {
  4.    size: 0,
  5.    aggregations: {
  6.    "ipv4-subnets": {
  7.    ip_prefix: {
  8.    field: 'ipv4',
  9.    prefix_length: 24,
  10.    keyed: true
  11.    }
  12.    }
  13.    }
  14.   }
  15. )
  16. puts response

Js

  1. const response = await client.search({
  2.   index: "network-traffic",
  3.   size: 0,
  4.   aggs: {
  5.    "ipv4-subnets": {
  6.    ip_prefix: {
  7.    field: "ipv4",
  8.    prefix_length: 24,
  9.    keyed: true,
  10.    },
  11.    },
  12.   },
  13. });
  14. console.log(response);

コンソール

  1. GET /network-traffic/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.    "ipv4-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv4",
  8.    "prefix_length": 24,
  9.    "keyed": true
  10.    }
  11.    }
  12.   }
  13. }

応答:

コンソール-結果

  1. {
  2.   ...
  4.   "aggregations": {
  5.    "ipv4-subnets": {
  6.    "buckets": {
  7.    "192.168.1.0": {
  8.    "is_ipv6": false,
  9.    "doc_count": 4,
  10.    "prefix_length": 24,
  11.    "netmask": "255.255.255.0"
  12.    },
  13.    "192.168.2.0": {
  14.    "is_ipv6": false,
  15.    "doc_count": 3,
  16.    "prefix_length": 24,
  17.    "netmask": "255.255.255.0"
  18.    },
  19.    "192.168.3.0": {
  20.    "is_ipv6": false,
  21.    "doc_count": 2,
  22.    "prefix_length": 24,
  23.    "netmask": "255.255.255.0"
  24.    }
  25.    }
  26.    }
  27.   }
  28. }

IPアドレスキーにプレフィックス長を追加

  2. 例:
  5. #### Python
  7. ``````python
  8. resp = client.search(
  9.    index="network-traffic",
  10.    size=0,
  11.    aggs={
  12.    "ipv4-subnets": {
  13.    "ip_prefix": {
  14.    "field": "ipv4",
  15.    "prefix_length": 24,
  16.    "append_prefix_length": True
  17.    }
  18.    }
  19.    },
  20. )
  21. print(resp)
  22. `

Ruby

  1. response = client.search(
  2.   index: 'network-traffic',
  3.   body: {
  4.    size: 0,
  5.    aggregations: {
  6.    "ipv4-subnets": {
  7.    ip_prefix: {
  8.    field: 'ipv4',
  9.    prefix_length: 24,
  10.    append_prefix_length: true
  11.    }
  12.    }
  13.    }
  14.   }
  15. )
  16. puts response

Js

  1. const response = await client.search({
  2.   index: "network-traffic",
  3.   size: 0,
  4.   aggs: {
  5.    "ipv4-subnets": {
  6.    ip_prefix: {
  7.    field: "ipv4",
  8.    prefix_length: 24,
  9.    append_prefix_length: true,
  10.    },
  11.    },
  12.   },
  13. });
  14. console.log(response);

コンソール

  1. GET /network-traffic/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.    "ipv4-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv4",
  8.    "prefix_length": 24,
  9.    "append_prefix_length": true
  10.    }
  11.    }
  12.   }
  13. }

応答:

コンソール-結果

  1. {
  2.   ...
  4.   "aggregations": {
  5.    "ipv4-subnets": {
  6.    "buckets": [
  7.    {
  8.    "key": "192.168.1.0/24",
  9.    "is_ipv6": false,
  10.    "doc_count": 4,
  11.    "prefix_length": 24,
  12.    "netmask": "255.255.255.0"
  13.    },
  14.    {
  15.    "key": "192.168.2.0/24",
  16.    "is_ipv6": false,
  17.    "doc_count": 3,
  18.    "prefix_length": 24,
  19.    "netmask": "255.255.255.0"
  20.    },
  21.    {
  22.    "key": "192.168.3.0/24",
  23.    "is_ipv6": false,
  24.    "doc_count": 2,
  25.    "prefix_length": 24,
  26.    "netmask": "255.255.255.0"
  27.    }
  28.    ]
  29.    }
  30.   }
  31. }

最小ドキュメント数

  3. #### Python
  5. ``````python
  6. resp = client.search(
  7.    index="network-traffic",
  8.    size=0,
  9.    aggs={
  10.    "ipv4-subnets": {
  11.    "ip_prefix": {
  12.    "field": "ipv4",
  13.    "prefix_length": 24,
  14.    "min_doc_count": 3
  15.    }
  16.    }
  17.    },
  18. )
  19. print(resp)
  20. `

Ruby

  1. response = client.search(
  2.   index: 'network-traffic',
  3.   body: {
  4.    size: 0,
  5.    aggregations: {
  6.    "ipv4-subnets": {
  7.    ip_prefix: {
  8.    field: 'ipv4',
  9.    prefix_length: 24,
  10.    min_doc_count: 3
  11.    }
  12.    }
  13.    }
  14.   }
  15. )
  16. puts response

Js

  1. const response = await client.search({
  2.   index: "network-traffic",
  3.   size: 0,
  4.   aggs: {
  5.    "ipv4-subnets": {
  6.    ip_prefix: {
  7.    field: "ipv4",
  8.    prefix_length: 24,
  9.    min_doc_count: 3,
  10.    },
  11.    },
  12.   },
  13. });
  14. console.log(response);

コンソール

  1. GET /network-traffic/_search
  2. {
  3.   "size": 0,
  4.   "aggs": {
  5.    "ipv4-subnets": {
  6.    "ip_prefix": {
  7.    "field": "ipv4",
  8.    "prefix_length": 24,
  9.    "min_doc_count": 3
  10.    }
  11.    }
  12.   }
  13. }

応答:

コンソール-結果

  1. {
  2.   ...
  4.   "aggregations": {
  5.    "ipv4-subnets": {
  6.    "buckets": [
  7.    {
  8.    "key": "192.168.1.0",
  9.    "is_ipv6": false,
  10.    "doc_count": 4,
  11.    "prefix_length": 24,
  12.    "netmask": "255.255.255.0"
  13.    },
  14.    {
  15.    "key": "192.168.2.0",
  16.    "is_ipv6": false,
  17.    "doc_count": 3,
  18.    "prefix_length": 24,
  19.    "netmask": "255.255.255.0"
  20.    }
  21.    ]
  22.    }
  23.   }
  24. }