Logo

A powerful, easily deployable network traffic analysis tool suite

Quick Start

Documentation

Components

Supported Protocols

Configuring

Arkime

Dashboards

Hedgehog Linux

Contribution Guide

Field Aggregations

GET or POST - /mapi/agg/<fieldname>

Executes an OpenSearch bucket aggregation query for the requested fields across all of Malcolm’s indexed network traffic metadata.

Parameters:

The from, to, and filter parameters can be used to further restrict the range of documents returned. The filter dictionary should be formatted such that its keys are field names and its values are the values for which to filter. A field name may be prepended with a ! to negate the filter (e.g., {"event.provider":"zeek"} vs. {"!event.provider":"zeek"}). Filtering for value null implies “is not set” or “does not exist” (e.g., {"event.dataset":null} means “the field event.dataset is null/is not set” while {"!event.dataset":null} means “the field event.dataset is not null/is set”).

Examples of filter parameter:

See Examples for more examples of filter and corresponding output.