需要查询表中的条件sql语句如下:
SELECT * FROM tablename
WHERE (md5='000000000000000000000000' AND dstip='1.2.3.4')
OR (fmd5='111111111111111111111' AND ip='5.6.7.8');
【解决】
使用Elastic的DSL结构化查询语句,如下:
{
"query": {
"filtered": {
"query" : {
"match_all":{}
},
"filter" : {
"or" : [
{
"and" : [
{"term":{"md5": "6133216c851e44eaf2f47b4eea2bf2df"}},
{"term":{"dstip": "61.54.221.200"}}
]
},
{
"and" : [
{"term":{"fmd5": "59bb8a9905e0856f464b97d5db27bb4a"}},
{"term":{"ip": "none"}}
]
}
]
}
}
},
"from": 0,
"size": 10,
"sort": [],
"aggs": {}
}
【备注】
Elastic的term查询一般如下,只能进行一个字段的查询:
{
"query": {
"bool": {
"must": [
{
"term": {
"md5": "123123123123123"
}
},
{
"term": {
"dstip": "2.3.4.5"
}
}
],
"must_not": [],
"should": []
}
},
"from": 0,
"size": 10,
"sort": [],
"aggs": {}
}