过滤 Elasticsearch 术语查询

Question

I am looking for the last time any user has logged in.

I have two authentication types ( Admin, Client) and am trying to do a query to find the event: Authentication succeeded Where authentication_type: Client

closest I have come is:

params='{ "query":{"terms":{"event_type":["authentication_succeeded"]}}}'
data=$(curl -XGET "localhost:9200/logstash-*/_search?scroll=10m&size=500&pretty" -H 'Content-Type: application/json' -d"${params}")

After many variations and alternate query types but I have not been able to successfully append the filter for '{"authentication_type":"Client"}'

Answer 1

You need to define your authentication_type and event_type as keyword and then use the term filters on these fields in your search query.

You can read with an example filter with multiple terms in this official ES link .

Below is a step by step example which uses your data to show the expected search results.

Index mapping

{
  "mappings": {
    "properties": {
      "authentication_type": {
        "type": "keyword"
      },
      "event_type" :{
        "type" : "keyword"
      }
    }
  }
}

Index sample docs

{
   "authentication_type" : "Client",
   "event_type" : "authentication_succeeded"
}

{
   "authentication_type" : "Client",
   "event_type" : "authentication_failed"
}

{
   "authentication_type" : "Admin",
   "event_type" : "authentication_succeeded"
}

{
   "authentication_type" : "Admin",
   "event_type" : "authentication_failed"
}

Search query

{
    "query": {
        "bool": {
            "filter": [
                {
                    "term": {
                        "event_type": "authentication_succeeded"
                    }
                },
                {
                    "term": {
                        "authentication_type": "Client"
                    }
                }
            ]
        }
    }
}

Search Result

"hits": [
         {
            "_index": "so_60750542",
            "_type": "_doc",
            "_id": "1",
            "_score": 0.0,
            "_source": {
               "authentication_type": "Client",
               "event_type": "authentication_succeeded"
            }
         }
      ]