Aggregate traffic by field
malcolm_aggregateRead-only
Count distinct values in network traffic by aggregating into top-N buckets per field. Use it to identify top talkers, protocol distributions, or other field value rankings.
Instructions
Aggregate network traffic into top-N value buckets for one or more fields.
Use this to count distinct values (top talkers, protocol distribution)
rather than fetch documents — for the documents themselves use
malcolm_search. For distinct values of a single field with less setup,
malcolm_field_values is simpler. Returns the raw Malcolm /mapi/agg
response (bucket keys with doc counts); when no buckets came back and an
aggregated or filtered field is not one Malcolm indexes, the correct
field name is reported above the response.
With no time_from this covers only the LAST 24 HOURS, unlike
malcolm_search which covers all history. Against a capture older than a
day that returns an empty bucket list, which reads as "no such traffic"
when it means "nothing in the last day" — suspect the window before the
data.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max buckets per aggregation level. | |
| fields | Yes | Comma-separated field names to aggregate on; multiple fields give multi-level buckets. E.g. "network.protocol"; "source.ip,destination.ip"; "rule.name,suricata.alert.severity". | |
| doctype | No | Target index selector (see malcolm_search). Empty = network index. | |
| filters | No | JSON filter object (Malcolm filter syntax, see malcolm_search). | {} |
| time_to | No | End time, dateparser format. Empty = now. | |
| time_from | No | Start time, dateparser format. Empty = the LAST 24 HOURS (unlike malcolm_search, which defaults to all history) — pass a range to reach older data. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |