Hello!
I trying to parse search requests to one of my elastic database and i don`t know what to do when a two- or more-word search come.
Config:
input {
beats {
port => 5044
}
}
filter {
if "bulk" in [url][path] {
drop { }
}
if "search" in [request] {
grok {
match => { '[http][request][body][content]' => '(?<search_pattern>(?<=query\": \")\w{1,})'}
}
grok {
match => { "[url][path]" => "/(?.*)shared.\d_.\d/"}
}
mutate {
update => { "query_full" => "{%{query_body}" }
}
}
}
output {
if "search" in [request] and "ignore_unmapped" not in [query_body]{
elasticsearch {
hosts => "rndtfsstgtools2:9200"
}
}
}
Request body:
POST /workitemsearchshared_0_2/workItemContract/_count?routing=f97e12fe-a1c6-41e6-b004-8bcec4a02473%2Cef42fcd5-a256-4df5-b832-ddc971a538ca&terminate_after=51 HTTP/1.1\r\nAccept: application/json\r\nContent-Type: application/json\r\nAuthorization: Basic ZWxhc3RpY3VzZXI6TGFtYTNsZXI3\r\nHost: rndtfsstgsearch:9200\r\nContent-Length: 4169\r\nConnection: Keep-Alive\r\n\r\n{"query":{\r\n "bool": {\r\n "must": {\r\n "bool": {\r\n "must": [\r\n {\r\n "multi_match": {\r\n "query": "credentials",\r\n "fields": [\r\n "fields.str","fields.str.stemmed","fields.html","fields.html.stemmed","fields.path","fields.str|title|system$","fields.str|title|system$.stemmed","fields.str|tags|system$","fields.str|tags|system$.stemmed","fields.path|areapath|system$","fields.path|areapath|system$.stemmed","fields.path|iterationpath|system$","fields.path|iterationpath|system$.stemmed","fields.str|state|system$","fields.str|state|system$.stemmed","fields.str|assignedto|system$","fields.str|assignedto|system$.stemmed","fields.str|createdby|system$","fields.str|createdby|system$.stemmed","fields.html|description|system$","fields.html|description|system$.stemmed","fields.html|history|system$","fields.html|history|system$.stemmed","fields.html|reprosteps|microsoft>vsts>tcm$","fields.html|reprosteps|microsoft>vsts>tcm$.stemmed","fields.html|steps|microsoft>vsts>tcm$","fields.html|steps|microsoft>vsts>tcm$.stemmed","fields.str|title|system$^10","fields.str|title|system$.stemmed^10","fields.html|description|system$^5","fields.html|description|system$.stemmed^5","fields.str|assignedto|system$^4"\r\n ],\r\n "type": "phrase"\r\n }\r\n },\r\n {\r\n "multi_match": {\r\n "query": "password",\r\n "fields": [\r\n "fields.str","fields.str.stemmed","fields.html","fields.html.stemmed","fields.path","fields.str|title|system$","fields.str|title|system$.stemmed","fields.str|tags|system$","fields.str|tags|system$.stemmed","fields.path|areapath|system$","fields.path|areapath|system$.stemmed","fields.path|iterationpath|system$","fields.path|iterationpath|system$.stemmed","fields.str|state|system$","fields.str|state|system$.stemmed","fields.str|assignedto|system$","fields.str|assignedto|system$.stemmed","fields.str|createdby|system$","fields.str|createdby|system$.stemmed","fields.html|description|system$","fields.html|description|system$.stemmed","fields.html|history|system$","fields.html|history|system$.stemmed","fields.html|reprosteps|microsoft>vsts>tcm$","fields.html|reprosteps|microsoft>vsts>tcm$.stemmed","fields.html|steps|microsoft>vsts>tcm$","fields.html|steps|microsoft>vsts>tcm$.stemmed","fields.str|title|system$^10","fields.str|title|system$.stemmed^10","fields.html|description|system$^5","fields.html|description|system$.stemmed^5","fields.str|assignedto|system$^4"\r\n ],\r\n "type": "phrase"\r\n }\r\n.....
Search query:
Matches:
How i can resolve it in regex or logstash or maybe i need use different scheme to resolve me Issue. And please sorry for my English.