如何在弹性搜索中比较来自两个不同特定日志的两个源 IP

Question

In Elasticsearch I want to compare two logs ( natlog and Gateway log ) with DSL Query.

In nat log there is srcip1 and In gateway log there is srcip2

I want to if this condition srcip1 === srcip2 satisfied, "agent.id" display in result.

On top of it I will put my already corelated query which I have made

{
  "query": {
    "bool": {
      "should": [
        {
          "match": {
            "location": "\\Users\\Saad\\Desktop\\nat.log"
          }
        },
        {
          "match": {
            "location": "\\Users\\Saad\\Desktop\\attendance-logs-with-ports.log"
          }
        }
      ],
      "must": [
        {
          "term": {
            "data.srcip": "1.1.1.1"
          }
        }
      ]
    }
  },
  "fields": [
    "data.srcip1"
  ],
  "_source": false
  
}

I tried multiple things but not succeeded.

Answer 1

To display summaries of data you use aggregations. In case you want to compare the different agents depending on the log type for a certain ip the query will be this one:

Ingest data

POST test_saad/_doc
{
  "location": "\\Users\\Saad\\Desktop\\nat.log",
  "data": {
    "srcip1": "1.1.1.1"
  },
  "agent": {
    "id": "agent_1"
  }
}

POST test_saad/_doc
{
  "location": "\\Users\\Saad\\Desktop\\attendance-logs-with-ports.log",
  "data": {
    "srcip2": "1.1.1.1"
  },
  "agent": {
    "id": "agent_1"
  }
}

POST test_saad/_doc
{
  "location": "\\Users\\Saad\\Desktop\\nat.log",
  "data": {
    "srcip1": "1.1.1.1"
  },
  "agent": {
    "id": "agent_2"
  }
}

Request

POST test_saad/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "bool": {
            "should": [
              {
                "term": {
                  "data.srcip1.keyword": "1.1.1.2"
                }
              },
              {
                "term": {
                  "data.srcip2.keyword": "1.1.1.2"
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "bool": {
            "should": [
              {
                "term": {
                  "location.keyword": """\Users\Saad\Desktop\nat.log"""
                }
              },
              {
                "term": {
                  "location.keyword": """\Users\Saad\Desktop\attendance-logs-with-ports.log"""
                }
              }
            ],
            "minimum_should_match": 1
          }
        }
      ]
    }
  },
  "aggs": {
    "log_types": {
      "terms": {
        "field": "location.keyword",
        "size": 10
      },
      "aggs": {
        "agent_types": {
          "terms": {
            "field": "agent.id.keyword",
            "size": 10
          }
        }
      }
    }
  }
}

Response

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  },
  "aggregations" : {
    "log_types" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : """\Users\Saad\Desktop\nat.log""",
          "doc_count" : 2,
          "agent_types" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "agent_1",
                "doc_count" : 1
              },
              {
                "key" : "agent_2",
                "doc_count" : 1
              }
            ]
          }
        },
        {
          "key" : """\Users\Saad\Desktop\attendance-logs-with-ports.log""",
          "doc_count" : 1,
          "agent_types" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "agent_1",
                "doc_count" : 1
              }
            ]
          }
        }
      ]
    }
  }
}