ElasticSearch：「IN」演算子

Question

でネストされたクエリは、私は私のインデックスのデータを次ています

{ 
    "took": 1, 
    "timed_out": false, 
    "_shards": { 
     "total": 5, 
     "successful": 5, 
     "failed": 0 
    }, 
    "hits": { 
     "total": 4, 
     "max_score": 1, 
     "hits": [ 
     { 
      "_index": "para-slapdmine-logs-2016.11.11", 
      "_score": 1, 
      "_source": { 
       "message": "<167>Nov 11 16:22:05 red5admin slapd[45740]: 
conn=1046 op=0 RESULT tag=97 err=49 text=", 
       "@timestamp": "2016-11-11T10:52:42.921Z", 
       "timestamp": "Nov 11 16:22:05", 
       "connection": 1046, 
       "operation_number": 0, 
       "tag": 97, 
       "error_code": 49 
      } 
     }, 
     { 
      "_index": "para-slapdmine-logs-2016.11.11", 
      "_score": 1, 
      "_source": { 
       "message": "<167>Nov 11 16:22:05 red5admin slapd[45740]: 
conn=1046 fd=13 ACCEPT from IP=10.1.2.2:37713 (IP=0.0.0.0:389)", 
       "@version": "1", 
       "@timestamp": "2016-11-11T10:52:42.920Z", 
       "type": "slapdmine", 
       "timestamp": "Nov 11 16:22:05", 
       "connection": 1046, 
       "fd_number": "13", 
       "src_ip": "10.1.2.2" 
      } 
     }, 
     { 
      "_index": "para-slapdmine-logs-2016.11.11", 
      "_score": 1, 
      "_source": { 
       "message": "<167>Nov 11 16:22:05 red5admin slapd[45740]: 
conn=1046 op=0 BIND dn=\"uid=dharmikp,ou=python,dc=red5admin\" 
method=128", 
       "@version": "1", 
       "@timestamp": "2016-11-11T10:52:42.920Z", 
       "timestamp": "Nov 11 16:22:05", 
       "connection": 1046, 
       "operation_number": 0, 
       "operation_name": "BIND", 
       "bind_dn": "uid=dharmikp,ou=python,dc=red5admin", 
       "bind_method": "128" 
      } 
     }, 
     { 
      "_index": "para-slapdmine-logs-2016.11.11", 
      "_score": 1, 
      "_source": { 
       "message": "<167>Nov 11 16:22:05 red5admin slapd[45740]: 
conn=1046 op=1 UNBIND", 
       "@timestamp": "2016-11-11T10:52:42.953Z", 
       "type": "slapdmine", 
       "timestamp": "Nov 11 16:22:05", 
       "connection": 1046, 
       "operation_number": 1, 
       "operation_name": "UNBIND" 
      } 
     } 
     ] 
    } 
} 

私はerror_codeが49であるこれら二つは単一の文書に存在しますが、接続はない属性src_ipのリストを見つけたいですIDはその文書で同じです。私は、SQLクエリを記述しなければならないとしたら

は、私は次のよう

select src_ip from ldap where connection in (select connection 
from ldap where error_code = 49) 

ことを私はElasticSearchでこれを達成することができますどのように任意のアイデアを行っているのでしょうか？

ElasticSearch（2.3.3）の使用。私のインデックスの

マッピング

"para-slapdmine-logs-2016.11.11" : { 
    "mappings" : { 
     "slapdmine" : { 
     "properties" : { 
      "@timestamp" : { 
      "type" : "date", 
      "format" : "strict_date_optional_time||epoch_millis" 
      }, 
      "@version" : { 
      "type" : "string" 
      }, 
      "bind_dn" : { 
      "type" : "string" 
      }, 
      "bind_method" : { 
      "type" : "string" 
      }, 
      "connection" : { 
      "type" : "long" 
      }, 
      "dst_ip" : { 
      "type" : "string" 
      }, 
      "dst_port" : { 
      "type" : "string" 
      }, 
      "error_code" : { 
      "type" : "long" 
      }, 
      "fd_number" : { 
      "type" : "string" 
      }, 
      "host" : { 
      "type" : "string" 
      }, 
      "logsource" : { 
      "type" : "string" 
      }, 
      "message" : { 
      "type" : "string" 
      }, 
      "operation_name" : { 
      "type" : "string" 
      }, 
      "operation_number" : { 
      "type" : "long" 
      }, 
      "pid" : { 
      "type" : "string" 
      }, 
      "program" : { 
      "type" : "string" 
      }, 
      "src_ip" : { 
      "type" : "string" 
      }, 
      "src_port" : { 
      "type" : "string" 
      }, 
      "tag" : { 
      "type" : "long" 
      }, 
      "timestamp" : { 
      "type" : "string" 
      }, 
      "type" : { 
      "type" : "string" 
      } 
     } 
     } 
    } 
    } 

Answer 1

私たちは、この時点でのSQLのサブクエリのようなことを行うことができないかと思いますが、あなたたちはまだApplication-Side Joinを使用して行うことができます。このようなTermsクエリ：

GET /my_index/ldap/_search 
{ 
    "query": { 
    "bool": { 
     "filter": [{ "term": { "error_code": 49 }}] 
    } 
    } 
} 

GET /my_index/ldap/_search 
{ 
    "query": { 
    "bool": { 
     "filter": [{ "terms": { "connection": [RESULTS_FROM_FIRST_QUERY] }}] 
    } 
    } 
} 

これが役に立ちます。