IP Range Aggregation

The IP Range aggregation is a multi-bucket aggregation that creates buckets for ranges of IP addresses, either using from/to values or CIDR masks.

In order to use the IP Range aggregation import the following:

import zio.elasticsearch.aggregation.{IpRangeAggregation, IpRangeBound}
import zio.elasticsearch.ElasticAggregation.ipRangeAggregation

You can create an IpRangeAggregation using the ipRangeAggregation method this way:

val aggregation: IpRangeAggregation =
  ipRangeAggregation(
    name = "ipRangeAggregation",
    field = "ipField",
    range = IpRangeBound().to("10.0.0.5"),
    ranges = IpRangeBound().from("10.0.0.5")
  )

You can create a type-safe IpRangeAggregation using the ipRangeAggregation method this way:

val aggregation: IpRangeAggregation =
  ipRangeAggregation(
    name = "ipRangeAggregation",
    field = Document.stringField,
    range = IpRangeBound().to("10.0.0.5"),
    ranges = IpRangeBound().from("10.0.0.5")
  )

You can also use CIDR masks for ranges:

val aggregation: IpRangeAggregation =
  ipRangeAggregation(
    name = "ipRangeAggregation",
    field = "ipField",
    range = IpRangeBound().mask("10.0.0.0/25"),
    ranges = IpRangeBound().mask("10.0.0.128/25")
  )

If you want to associate each bucket with a unique string key, you can use the keyed method together with the key of each range:

val aggregationWithKeyed: IpRangeAggregation =
  ipRangeAggregation(
    name = "ipRangeAggregation",
    field = "ipField",
    range = IpRangeBound().mask("10.0.0.0/25").key("low"),
    ranges = IpRangeBound().mask("10.0.0.128/25").key("high")
  ).keyed

If you want to add aggregation (on the same level), you can use withAgg method:

val multipleAggregations: MultipleAggregations =
  ipRangeAggregation(name = "ipRangeAggregation", field = "ipField", range = IpRangeBound().to("10.0.0.5"))
    .keyed
    .withAgg(maxAggregation(name = "maxAggregation", field = "intField"))

If you want to add another sub-aggregation, you can use withSubAgg method:

val aggregationWithSubAgg: IpRangeAggregation =
  ipRangeAggregation(name = "ipRangeAggregation", field = "ipField", range = IpRangeBound().to("10.0.0.5"))
    .withSubAgg(maxAggregation(name = "maxAggregation", field = "intField"))

You can find more information about IP Range aggregation here.