下面是curl命令的输出,需要脚本或命令来打印小于10的“doc_count”并将“key”保存在output.txt文件中。
{
"took": 117,
"timed_out": false,
"_shards": {
"total": 1005,
"successful": 1005,
"skipped": 979,
"failed": 0
},
"hits": {
"total": 205,
"max_score": 0,
"hits": []
},
"aggregations": {
"2": {
"doc_count": 205,
"bg_count": 5778,
"buckets": [
{
"key": "51.79.100.225",
"doc_count": 24,
"score": 3.1826769779892925,
"bg_count": 24
},
{
"key": "169.45.76.172",
"doc_count": 13,
"score": 1.7239500297442,
"bg_count": 13
},
{
"key": "198.147.22.235",
"doc_count": 10,
"score": 1.3261154074955384,
"bg_count": 10
},
{
"key": "5.178.86.74",
"doc_count": 8,
"score": 0.9386793575252826,
"bg_count": 9
},
{
"key": "35.193.189.85",
"doc_count": 7,
"score": 0.928280785246877,
"bg_count": 7
},
{
"key": "5.101.0.209",
"doc_count": 6,
"score": 0.7956692444973231,
"bg_count": 6
},
{
"key": "103.102.138.250",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "194.60.254.128",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "222.186.19.221",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "109.234.153.132",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "110.173.179.66",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "81.92.200.229",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "109.234.153.131",
"doc_count": 4,
"score": 0.5304461629982153,
"bg_count": 4
},
{
"key": "109.234.153.133",
"doc_count": 3,
"score": 0.39783462224866156,
"bg_count": 3
},
{
"key": "182.59.108.9",
"doc_count": 3,
"score": 0.39783462224866156,
"bg_count": 3
},
{
"key": "178.137.19.29",
"doc_count": 6,
"score": 0.3514721090925732,
"bg_count": 13
},
{
"key": "178.137.17.210",
"doc_count": 3,
"score": 0.23284711481261156,
"bg_count": 5
},
{
"key": "5.178.86.78",
"doc_count": 3,
"score": 0.19160023795359907,
"bg_count": 6
}
]
}
},
"status": 200
}
答案1
jq -r '.aggregations."2".buckets[] | select(.doc_count < 100).key' file.json
.aggregations."2".buckets[]
这将选择数组中 a小于 100 的元素.doc_count
,然后获取.key
每个元素的值。
将其结果重定向到文件以保存它。