Hi Costin,
 
my query looks like this:
 
 POST _search
{
    "query": {
        "filtered": {
           "query": {
            "match_all": {}
           },
           "filter": {
               "bool": {
                   "must_not": [
                      {
                        "terms": {
                            "host": ["","Null"]
                        }
                      },{
                          "terms": {
                           "curr_subscr_id": ["","Null"]
                        }
                      }
                   ]
               }
           }
        }
    }, 
    "aggs":{
        "host_aggs":{
            "terms":{
                "field":"host"
            },
            "aggs":{
                "subscr_aggs":{
                    "cardinality":{
                        "field":"curr_subscr_id"
                    }
                }
            } 
        }
    }
    ,"size": 1
    ,"fields": [
       "age","start_time","host","_source"
    ]
}
 
 

-- 
You received this message because you are subscribed to the Google Groups 
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/elasticsearch/fb3b27b0-9ff2-435a-a216-f76079541dc3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to