## IP Range Aggregation 就像專用的[日期](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-daterange-aggregation.html)范圍聚合一樣，IP類型字段也有專用的范圍聚合: 例子： | `{` `"aggs" : {` `"ip_ranges" : {` `"ip_range" : {` `"field" : "ip",` `"ranges" : [` `{ "to" : "10.0.0.5" },` `{ "from" : "10.0.0.5" }` `]` `}` `}` `}` `}` | 響應結果： | `{` `...` `"aggregations": {` `"ip_ranges": {` `"buckets" : [` `{` `"to": "10.0.0.5",` `"doc_count": 4` `},` `{` `"from": "10.0.0.5",` `"doc_count": 6` `}` `]` `}` `}` `}` | IP范圍也可以定義為CIDR掩碼 | `{` `"aggs" : {` `"ip_ranges" : {` `"ip_range" : {` `"field" : "ip",` `"ranges" : [` `{ "mask" : "10.0.0.0/25" },` `{ "mask" : "10.0.0.127/25" }` `]` `}` `}` `}` `}` | 響應結果： | `{` `"aggregations": {` `"ip_ranges": {` `"buckets": [` `{` `"key": "10.0.0.0/25",` `"from": "10.0.0.0",` `"to": "10.0.0.127",` `"doc_count": 127` `},` `{` `"key": "10.0.0.127/25",` `"from": "10.0.0.0",` `"to": "10.0.0.127",` `"doc_count": 127` `}` `]` `}` `}` `}` | ? ### Keyed Response 將keyed標志設置為true會將一個惟一的字符串鍵與每個bucket關聯起來，并將范圍作為散列而不是數組返回: | `{` `"aggs": {` `"ip_ranges": {` `"ip_range": {` `"field": "remote_ip",` `"ranges": [` `{ "to" : "10.0.0.5" },` `{ "from" : "10.0.0.5" }` `],` `"keyed": true` `}` `}` `}` `}` | 響應結果： | `{` `...` `"aggregations": {` `"ip_ranges": {` `"buckets": {` `"*-10.0.0.5": {` `"to": "10.0.0.5",` `"doc_count": 1462` `},` `"10.0.0.5-*": {` `"from": "10.0.0.5",` `"doc_count": 50000` `}` `}` `}` `}` `}` | 可以為每一個范圍自定義key： | `{` `"aggs": {` `"ip_ranges": {` `"ip_range": {` `"field": "remote_ip",` `"ranges": [` `{ "key": "infinity", "to" : "10.0.0.5" },` `{ "key": "and-beyond", "from" : "10.0.0.5" }` `],` `"keyed": true` `}` `}` `}` `}` | 響應結果： | `{` `...` `"aggregations": {` `"ip_ranges": {` `"buckets": {` `"infinity": {` `"to": "10.0.0.5",` `"doc_count": 1462` `},` `"and-beyond": {` `"from": "10.0.0.5",` `"doc_count": 50000` `}` `}` `}` `}` `}` |