es - elasticsearch - aggs - bucket - ip

世界上并没有完美的程序，但是我们并不因此而沮丧，因为写程序就是一个不断追求完美的过程。

问：ip_range有什么特点？
答：

问：ip_range如何使用？
答：

# 删除
DELETe /ip_range_test

# 映射
PUT /ip_range_test
{
  "mappings": {
    "properties": {
      "ip": {"type": "ip"}
    }
  }
}

# 索引
POST /ip_range_test/_bulk?routing=1&refresh
{"index": {"_id": 1}}
{"ip": "192.168.2.8"}
{"index": {"_id": 2}}
{"ip": "192.168.2.78"}
{"index": {"_id": 3}}
{"ip": "192.168.2.38"}
{"index": {"_id": 4}}
{"ip": "192.168.2.58"}
{"index": {"_id": 5}}
{"ip": "192.168.2.88"}


# 搜索
GET /ip_range_test/_search?size=0
{
  "aggs": {
    "ip_range_aggs": {
      "ip_range": {
        "field": "ip",
        "ranges": [
          {
            "to": "192.168.2.10"
          },
          {
            "from": "192.168.2.37",
            "to": "192.168.2.59"
          },
          {
            "from": "192.168.2.60"
          }
        ]
      }
    }
  }
}

# 结果
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 5,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "ip_range_aggs" : {
      "buckets" : [
        {
          "key" : "*-192.168.2.10",
          "to" : "192.168.2.10",
          "doc_count" : 1
        },
        {
          "key" : "192.168.2.37-192.168.2.59",
          "from" : "192.168.2.37",
          "to" : "192.168.2.59",
          "doc_count" : 2
        },
        {
          "key" : "192.168.2.60-*",
          "from" : "192.168.2.60",
          "doc_count" : 2
        }
      ]
    }
  }
}