"aggs": {
    "2": {
      "terms": {
        "field": "dns.question.type",
        "size": 1000,
        "order": {
          "_count": "desc"
        }

SearchResponse response = client.prepareSearch("packetbeat")
   .setQuery(QueryBuilders.rangeQuery("@timestamp").gte("now-12d").lt("now-10d"))
   .addAggregation(AggregationBuilders.terms("")

SearchHit[] hits = response.getHits().getHits();
Map<String, Object> result = hits[0].sourceAsMap();