ES|QL Search if a value in a list is in another list

Elastic Stack Kibana
1

Trying to find all instances of "-a" or "-x" in process arguments, from endpoint logs. I have the following values:

process.name: "process"
process.command_line: "process -a -b -c"
process.args: ["process", "-a", "-b" "-c"]

process.name: "process"
process.command_line: "process -x -b -c"
process.args: ["process", "-x", "-b" "-c"]

The following query returns what I would expect:

from logs-*endpoint*
| where process.command_line LIKE "*-a*" OR process.command_line LIKE "*-x*"

This query returns nothing.

from logs-*endpoint*
| where process.args IN ("-a", "-x") //returns nothing

How do I query for values that are stored as a list, if they belong to another list?

2

from logs-endpoint
| where process.args IN ("-a", "-x") //returns nothing

I believe IN expects a single element on the left side and doesn't work in that way.

My ES|QL knowledge is still growing. I did find a way to do this but it's a bit messy.

FROM logs-* | 
eval values = ["start","connection"] |
WHERE MV_COUNT(MV_DEDUPE(MV_APPEND(event.type, values))) < (MV_DEDUPE(MV_COUNT(event.type)) + MV_COUNT(values)) |
LIMIT 1000

Essentially values is set to the values you want to check for and then I used
WHERE MV_COUNT(MV_DEDUPE(MV_APPEND(event.type, values))) < (MV_COUNT(event.type) + MV_COUNT(values))

With MV_COUNT(MV_DEDUPE(MV_APPEND(event.type, values))) being used to join the two lists, remove duplicates, and then take a count, and
(MV_COUNT(MV_DEDUPE(event.type)) + MV_COUNT(values)) being used to join the two lists, keep duplicates, and then take a count.

If these two numbers aren't the same, it means there was a duplicate across the two lists, that is that at least one of the items in values was in event.type.

Hopefully there's an easier way to do this and someone will come along with a better suggestion!

3

Hello Strawgate, I will let you know how this works when our stack gets updated to 8.16 and includes MV_APPEND(). This solution seems clever though, and I appreciate the help. I assume this will have better runtimes than the expensive process.command_line LIKE "*something*" operation.