Question

这是我的REST API：

GET logstash-2017.12.29/_search
{
"_source": {
"includes": [ "IPV4_DST_ADDR","IPV4_SRC_ADDR","IN_BYTES","OUT_BYTES"]
},
"size" : 100,
"query": {
"bool": {
"should": [
{
    "match_phrase":{"IPV4_DST_ADDR":"192.168.0.159"}
},
{
    "match_phrase":{"IPV4_SRC_ADDR":"192.168.0.159"}
}
],
"must":
{
  "range" : {
    "LAST_SWITCHED" : {
        "gte" : 1514543547
    }
    }
}
}
},
"aggs": {
"IN_PKTS": {
"sum": {
  "field": "IN_PKTS"
}
},
"IN_BYTES": {
"sum": {
  "field": "IN_BYTES"
}
},
"OUT_BYTES": {
"sum": {
  "field": "OUT_BYTES"
}
},
"OUT_PKTS": {
"sum": {
  "field": "OUT_PKTS"
}
},
"genres":{
"terms" : {
        "field" : "L7_PROTO_NAME.keyword",
        "order" : { "in_bytes" : "desc" }
    },
"aggs":{
  "in_bytes": {
  "sum": { "field":"IN_BYTES"}
}
}
},
"download1" : {
    "filter" : { "term": { "IPV4_DST_ADDR":"192.168.0.159"} },
    "aggs" : {
        "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
    }
},
"download2" : {
    "filter" : { "term": { "IPV4_SRC_ADDR":"192.168.0.159"} },
    "aggs" : {
        "downlod_bytes" : { "sum" : { "field" : "OUT_BYTES" } }
    }
},"upload1" : {
    "filter" : { "term": { "IPV4_DST_ADDR":"192.168.0.159"} },
    "aggs" : {
        "downlod_bytes" : { "sum" : { "field" : "OUT_BYTES" } }
    }
},"upload2" : {
    "filter" : { "term": { "IPV4_SRC_ADDR":"192.168.0.159"} },
    "aggs" : {
        "downlod_bytes" : { "sum" : { "field" : "IN_BYTES" } }
    }
}
}

我发现有一些退货文件不符合我的要求。

{
"_index": "logstash-2017.12.29",
"_type": "ntopng-*",
"_id": "AWCh1jPtnZ2m3739FTU7",
"_score": 1,
"_source": {
"IPV4_SRC_ADDR": "192.168.0.109", // not in my expectation     
"IN_BYTES": 132,
"IPV4_DST_ADDR": "224.0.0.252", // not in my expectation
"OUT_BYTES": 0
}
}

退货单据IPV4_SRC_ADDR或IPV4_DST_ADDR不是“192.168.0.159”。它似乎模糊搜索，但我想match_phrase 100％。 IPV4_SRC_ADDR或IPV4_DST_ADDR为“192.168.0.159”。我应该如何修改我的REST API。提前谢谢你！

Answer 1

您应使用ip data type

映射您的IP字段

{
  "mappings": {
    "my_type": {
      "properties": {
        "IPV4_SRC_ADDR": {
          "type": "ip"
        },
        "IPV4_DST_ADDR": {
          "type": "ip"
        }
      }
    }
  }
}

然后，您就可以使用简单的term查询完全匹配这些地址：

"should": [
{
    "term":{"IPV4_DST_ADDR":"192.168.0.159"}
},
{
    "term":{"IPV4_SRC_ADDR":"192.168.0.159"}
}
],

更新：

根据您的映射，您还可以使用.keyword子字段，如此

{
  "_source": {
    "includes": [
      "IPV4_DST_ADDR",
      "IPV4_SRC_ADDR",
      "IN_BYTES",
      "OUT_BYTES"
    ]
  },
  "size": 100,
  "query": {
    "bool": {
      "minimum_should_match": 1,
      "should": [
        {
          "term": {
            "IPV4_DST_ADDR.keyword": "192.168.0.159"
          }
        },
        {
          "term": {
            "IPV4_SRC_ADDR.keyword": "192.168.0.159"
          }
        }
      ],
      "must": {
        "range": {
          "LAST_SWITCHED": {
            "gte": 1514543547
          }
        }
      }
    }
  },
  "aggs": {
    "IN_PKTS": {
      "sum": {
        "field": "IN_PKTS"
      }
    },
    "IN_BYTES": {
      "sum": {
        "field": "IN_BYTES"
      }
    },
    "OUT_BYTES": {
      "sum": {
        "field": "OUT_BYTES"
      }
    },
    "OUT_PKTS": {
      "sum": {
        "field": "OUT_PKTS"
      }
    },
    "genres": {
      "terms": {
        "field": "L7_PROTO_NAME.keyword",
        "order": {
          "in_bytes": "desc"
        }
      },
      "aggs": {
        "in_bytes": {
          "sum": {
            "field": "IN_BYTES"
          }
        }
      }
    },
    "download1": {
      "filter": {
        "term": {
          "IPV4_DST_ADDR.keyword": "192.168.0.159"
        }
      },
      "aggs": {
        "download_bytes": {
          "sum": {
            "field": "IN_BYTES"
          }
        }
      }
    },
    "download2": {
      "filter": {
        "term": {
          "IPV4_SRC_ADDR.keyword": "192.168.0.159"
        }
      },
      "aggs": {
        "downlod_bytes": {
          "sum": {
            "field": "OUT_BYTES"
          }
        }
      }
    },
    "upload1": {
      "filter": {
        "term": {
          "IPV4_DST_ADDR.keyword": "192.168.0.159"
        }
      },
      "aggs": {
        "downlod_bytes": {
          "sum": {
            "field": "OUT_BYTES"
          }
        }
      }
    },
    "upload2": {
      "filter": {
        "term": {
          "IPV4_SRC_ADDR.keyword": "192.168.0.159"
        }
      },
      "aggs": {
        "downlod_bytes": {
          "sum": {
            "field": "IN_BYTES"
          }
        }
      }
    }
  }
}

Match_phrase不准确

1 个答案: