gistfile1.py

curl localhost:9200/_all/_search -d '{
  "size" : 10000,
  "query": {
    "function_score": {
      "query": { "query_string": { "query" : "*" }},
      "random_score": {
        "seed": 1379333621000
      }
    }
  }
}' > /tmp/foo.json

$ ipython
In [1]: import json
In [2]: j = json.load(open('/tmp/foo.json'))
In [3]: c10=0; c100=0; c1000=0; c10000=0; cplus=0
In [4]: for event in j['hits']['hits']:
    if len(event['_source']['message']) < 10: c10 = c10 + len(event['_source']['message'])
    elif len(event['_source']['message']) < 100: c100 = c100 + len(event['_source']['message'])
    elif len(event['_source']['message']) < 1000: c1000 = c1000 + len(event['_source']['message'])
    elif len(event['_source']['message']) < 10000: c10000 = c10000 + len(event['_source']['message'])
    elif len(event['_source']['message']) > 10000: cplus = cplus + len(event['_source']['message'])
In [5]: print 'Size of bucket: 10b: %s 100b: %s 1000b: %s 10000b: %s bigger: %s' % (c10, c100, c1000, c10000, cplus)
In [6]: for event in j['hits']['hits']:
    if len(event['_source']['message']) < 10: c10 = c10 + 1
    elif len(event['_source']['message']) < 100: c100 = c100 + 1
    elif len(event['_source']['message']) < 1000: c1000 = c1000 + 1
    elif len(event['_source']['message']) < 10000: c10000 = c10000 + 1
    elif len(event['_source']['message']) > 10000: cplus = cplus + 1
In [7]: print 'Count per bucket: 10b: %s 100b: %s 1000b: %s 10000b: %s bigger: %s' % (c10, c100, c1000, c10000, cplus)