目录

• nested aggs-filter aggs-terms
• nested must must_not exists
• nested aggs-terms
• nested must exists

nested must exists

{
  "_source": [
    "leak",
    "ip",
    "port",
    "created_at",
    "updated_at"
  ],
  "sort": {
    "updated_at": "desc"
  },
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "leak",
            "query": {
              "exists": {
                "field": "leak.cve_id"
              }
            }
          }
        }
      ],
      "must_not": [

      ]
    }
  }
}

nested aggs-filter aggs-terms

{
  "_source": [
    "county",
    "ip",
    "port",
    "softwares",
    "updated_at"
  ],
  "size": 0,
  "aggs": {
    "softwares": {
      "nested": {
        "path": "softwares"
      },
      "aggs": {
        "python": {
          "filter": {
            "term": {
              "softwares.software": "python"
            }
          },
          "aggs": {
            "software_version": {
              "terms": {
                "field": "softwares.software_version",
                "size": 20
              }
            }
          }
        }
      }
    }
  }
}

nested must must_not exists

{
  "_source": [
    "softwares",
    "ip",
    "port",
    "created_at",
    "updated_at"
  ],
  "sort": {
    "updated_at": "desc"
  },
  "query": {
    "bool": {
      "must": [
        {
          "nested": {
            "path": "softwares",
            "query": {
              "bool": {
                "must": [
                  {
                    "term": {
                      "softwares.software": "python"
                    }
                  }
                ]
              }
            }
          }
        }
      ],
      "must_not": [
        {
          "nested": {
            "path": "softwares",
            "query": {
              "exists": {
                "field": "softwares.software_version"
              }
            }
          }
        }
      ]
    }
  }
}

nested terms-aggs

{
  "_source": [
    "county",
    "ip",
    "port",
    "softwares",
    "updated_at"
  ],
  "size": 0,
  "aggs": {
    "softwares": {
      "nested": {
        "path": "softwares"
      },
      "aggs": {
        "software_version": {
          "terms": {
            "field": "softwares.software_version",
            "size": 100
          }
        }
      }
    }
  }
}