问题描述
在 Elasticsearch 中，我想将两个日志（natlog 和 Gateway log）与 DSL 查询进行比较。
在 nat 日志中有 srcip1，在网关日志中有 srcip2
如果这个条件 srcip1 === srcip2 满足，我想在结果中显示 "agent.id"。
在它之上，我将放置我已经进行的相关查询
{
"query": {
"bool": {
"should": [
{
"match": {
"location": "\\Users\\Saad\\Desktop\\nat.log"
}
},{
"match": {
"location": "\\Users\\Saad\\Desktop\\attendance-logs-with-ports.log"
}
}
],"must": [
{
"term": {
"data.srcip": "1.1.1.1"
}
}
]
}
},"fields": [
"data.srcip1"
],"_source": false
}
我尝试了多种方法，但都没有成功。
解决方法
要显示您使用聚合的数据摘要。如果您想根据某个 ip 的日志类型比较不同的代理，查询将是这样的：
提取数据
POST test_saad/_doc
{
"location": "\\Users\\Saad\\Desktop\\nat.log","data": {
"srcip1": "1.1.1.1"
},"agent": {
"id": "agent_1"
}
}
POST test_saad/_doc
{
"location": "\\Users\\Saad\\Desktop\\attendance-logs-with-ports.log","data": {
"srcip2": "1.1.1.1"
},"agent": {
"id": "agent_1"
}
}
POST test_saad/_doc
{
"location": "\\Users\\Saad\\Desktop\\nat.log","agent": {
"id": "agent_2"
}
}
请求
POST test_saad/_search
{
"size": 0,"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"term": {
"data.srcip1.keyword": "1.1.1.2"
}
},{
"term": {
"data.srcip2.keyword": "1.1.1.2"
}
}
],"minimum_should_match": 1
}
},{
"bool": {
"should": [
{
"term": {
"location.keyword": """\Users\Saad\Desktop\nat.log"""
}
},{
"term": {
"location.keyword": """\Users\Saad\Desktop\attendance-logs-with-ports.log"""
}
}
],"minimum_should_match": 1
}
}
]
}
},"aggs": {
"log_types": {
"terms": {
"field": "location.keyword","size": 10
},"aggs": {
"agent_types": {
"terms": {
"field": "agent.id.keyword","size": 10
}
}
}
}
}
}
回复
{
"took" : 2,"timed_out" : false,"_shards" : {
"total" : 1,"successful" : 1,"skipped" : 0,"failed" : 0
},"hits" : {
"total" : {
"value" : 3,"relation" : "eq"
},"max_score" : null,"hits" : [ ]
},"aggregations" : {
"log_types" : {
"doc_count_error_upper_bound" : 0,"sum_other_doc_count" : 0,"buckets" : [
{
"key" : """\Users\Saad\Desktop\nat.log""","doc_count" : 2,"agent_types" : {
"doc_count_error_upper_bound" : 0,"buckets" : [
{
"key" : "agent_1","doc_count" : 1
},{
"key" : "agent_2","doc_count" : 1
}
]
}
},{
"key" : """\Users\Saad\Desktop\attendance-logs-with-ports.log""","doc_count" : 1,"doc_count" : 1
}
]
}
}
]
}
}
}