test.txt

": {
    "2": {
      "terms": {
        "field": "destination_ips.keyword",
        "size": 100,
        "order": {
          "_count": "asc"
        }
      },
      "aggs": {
        "3": {
          "terms": {
            "field": "destination_port",
            "size": 5,
            "order": {
              "_count": "desc"
            }
          }
        }
      }
    }
  },
  "size": 0,
  "_source": {
    "excludes": []
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "certificate_not_valid_after",
      "format": "date_time"
    },
    {
      "field": "certificate_not_valid_before",
      "format": "date_time"
    },
    {
      "field": "creation_date",
      "format": "date_time"
    },
    {
      "field": "creation_time",
      "format": "date_time"
    }
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1538861413029,
              "lte": 1538947813029,
              "format": "epoch_millis"
            }
          }
        },
        {
          "bool": {
            "should": [
              {
                "term": {
                  "destination_ip": "192.168.0.0/16"
                }
              },
              {
                "term": {
                  "destination_ip": "10.0.0.0/8"
                }
              },
              {
                "term": {
                  "destination_ip": "172.16.0.0/12"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "should": [
              {
                "term": {
                  "source_ip": "192.168.0.0/16"
                }
              },
              {
                "term": {
                  "source_ip": "10.0.0.0/8"
                }
              },
              {
                "term": {
                  "source_ip": "172.16.0.0/12"
                }
              }
            ]
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}