Question

我使用logstsah将我的aws云跟踪数据推送到所有区域的MongoDB，现在我的mongodb有很多日志作为文档。

下面的每个事件示例都是单个集合中的mongodb文档，

{
"_id": "5b1e4a1bf1f179e32000000a",
"@version": "1",
"@timestamp": "\"2018-06-11T10:08:26.984Z\"",
"source": "gzfiles",
"type": "cloudtrail",
"document_id": "204e8c48-4a0d-47f3-a344-6042360e9535",
"Records": {
    "eventID": "204e8c48-4a0d-47f3-a344-6042360t9535",
    "awsRegion": "us-west-2",
    "eventVersion": "1.04",
    "responseElements": null,
    "sourceIPAddress": "181.3.4.3",
    "eventSource": "logs",
    "requestParameters": {
        "logGroupName": "vpc-flow-logs",
        "logStreamName": "eni-06aaa0fd85d1450da-all"
    },
    "userAgent": "aws-vpc-flow-logs, aws-internal/3",
    "userIdentity": {
        "accessKeyId": "XXXXXXXXXXXXXXX",
        "sessionContext": {
            "sessionIssuer": {
                "accountId": "3333333333333",
                "principalId": "XXXXXXXXXXXXXXXXXXX",
                "type": "Role",
                "arn": "arn:aws:iam::33333333333:role/flowlogsRole",
                "userName": "flowlogsRole"
            },
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2018-06-11T09:57:08Z"
            }
        },
        "accountId": "33333333333333333",
        "principalId": "XXXXXXXXXXXXXXXX:vpc-flow-logging+33333333333333333",
        "type": "AssumedRole",
        "arn": "arn:aws:sts::333333333333:assumed-role/flowlogsRole/vpc-flow-logging+333333333333"
    },
    "eventType": "AwsApiCall",
    "apiVersion": "20140328",
    "requestID": "c4e57b1f-625d-11e8-aa69-f7549df37c2a",
    "eventTime": "2018-06-11T09:57:08Z",
    "eventName": "CreateLogStream",
    "recipientAccountId": "333333333333333"
}}

现在我想在mongo db中使用python文件查询，如果新记录只匹配“type”：“cloudtrail”或“type”：“ec2”那么我必须写入文件

这里的问题是如果我在mongodb中使用“type”：“ec2”进行过滤，每次从大量数据中取出时，我只需要从上次搜索中搜索最新值appart。

如何在Mongodb中实现这种查询？

如何只搜索mongodb usng pymongo中的新数据

0 个答案: