Elasticsearch进行and,or多条件组合DSL结构化查询

时间:2021-05-11 02:54:01
【问题
    需要查询表中的条件sql语句如下:
  

SELECT * FROM tablename 
WHERE (md5='000000000000000000000000' AND dstip='1.2.3.4') 
OR (fmd5='111111111111111111111' AND ip='5.6.7.8');

【解决】

使用Elastic的DSL结构化查询语句,如下:

{
"query": {
"filtered": {
"query" : {
"match_all":{}
},
"filter" : {
"or" : [
{
"and" : [
{"term":{"md5": "6133216c851e44eaf2f47b4eea2bf2df"}},
{"term":{"dstip": "61.54.221.200"}}
]
},
{
"and" : [
{"term":{"fmd5": "59bb8a9905e0856f464b97d5db27bb4a"}},
{"term":{"ip": "none"}}
]
}
]
}
}
},
"from": 0,
"size": 10,
"sort": [],
"aggs": {}
}

【备注】

Elastic的term查询一般如下,只能进行一个字段的查询:

{
"query": {
"bool": {
"must": [
{
"term": {
"md5": "123123123123123"
}
},
{
"term": {
"dstip": "2.3.4.5"
}
}
],
"must_not": [],
"should": []
}
},
"from": 0,
"size": 10,
"sort": [],
"aggs": {}
}


哦了,解决Elastic的多条件组合查询问题!