[source, ruby]
----
response = client.search(
  index: 'network-traffic',
  body: {
    size: 0,
    aggregations: {
      "ipv4-subnets": {
        ip_prefix: {
          field: 'ipv4',
          prefix_length: 24,
          min_doc_count: 3
        }
      }
    }
  }
)
puts response
----
