是时候用 ES 拯救发际线啦

多个ip范围 查询时,只显示最后一个符合ip的数据

Elasticsearch | 作者 youshangkuaile | 发布于2019年09月19日 | 阅读数:1216

{
"bool" : {
"must" : [
{
"term" : {
"event_source" : {
"value" : "10.2.2.231",
"boost" : 1.0
}
}
},
{
"bool" : {
"should" : [
{
"range" : {
"src_ip" : {
"from" : "1.1.1.3",
"to" : "1.1.1.5",
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
},
{
"range" : {
"src_ip" : {
"from" : "111.111.111.0",
"to" : "111.111.111.255",
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
},
{
"terms" : {
"src_ip" : [
"1.1.1.2"
],
"boost" : 1.0
}
},
{
"range" : {
"dst_ip" : {
"from" : "1.1.1.3",
"to" : "1.1.1.5",
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
},
{
"range" : {
"dst_ip" : {
"from" : "111.111.111.0",
"to" : "111.111.111.255",
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
},
{
"terms" : {
"dst_ip" : [
"1.1.1.2"
],
"boost" : 1.0
}
}
],
"disable_coord" : false,
"adjust_pure_negative" : true,
"boost" : 1.0
}
}
],
"filter" : [
{
"range" : {
"event_receive_time" : {
"from" : 1568290633638,
"to" : 1568895434035,
"include_lower" : true,
"include_upper" : true,
"boost" : 1.0
}
}
}
],
"disable_coord" : false,
"adjust_pure_negative" : true,
"boost" : 1.0
}
}
已邀请:

要回复问题请先登录注册