一、找出天天的獨立IP訪問來源code
使用nested aggregation,在一個date histogram aggregation作按照天分組後,再對天天的結果用cardinality aggregation計數ip
POST /access/search/_search { "size" : 0, "aggs" : { "dailyIP" : { "date_histogram" : {"field":"date", "interval" : "day"}, "aggs" : { "unique_ip" : {"cardinality" : {"field" : "IP"} } } } } }