ELK aggregation

GET logs/_search {"aggs":{"origenes":{"terms":{"field":"source.ip","size":10}}}}

Aggregation query against Elasticsearch that groups events by field (here source IP) directly on the API, without going through Kibana.

Run it when you need fast and reproducible aggregations on Elastic data without the Kibana interface: the _search endpoint with aggs returns the count grouped by the field you choose — the ranking of source IPs of failures, the hosts with most events, the most queried domains. It's the way for scripts and integrations: the same query is launched from Python, curl, or SOC automations. The terms aggregation with size limits the top N. It's how you ask volume questions directly to the engine, with minimal latency.

Don't use it for interactive analysis: Kibana (Discover/Lens) builds the same aggregations with clicks and visualization — the API is for scripts and automation. The JSON syntax of the query is strict: a misspelled field (source.ip vs source.ip.raw depending on mapping) returns an error or empty, and aggregations on text fields without fielddata fail — use the keyword field of the mapping (.keyword) for terms. And watch out for cost: heavy aggregations (terms with high size, cardinality) over wide ranges consume cluster memory; narrow the time range and size.