# Поиск пересечений по нескольким параметрам **URL:** \ **Category:** Вопросы на русском языке\ **Created:** [March 12, 2020, 9:17am UTC](https://discuss.elastic.co/t/topic/223294 "2020-03-12T09:17:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![coolmac](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@coolmac](https://discuss.elastic.co/u/coolmac)\ **Post date:** [March 12, 2020, 9:17am UTC](https://discuss.elastic.co/t/topic/223294/1 "2020-03-12T09:17:48Z")
Всем привет, есть такая задача по работе с Kibana и логами apache. Есть основной параметр: `destination.domain` Необходимо найти совпадения по трем параметрам, к примеру: ``` source.geo.region_name source.as.organization.name user_agent.original ``` Совпадения означает, что нужно выбрать только те строки в которые совпадают у разных destination.domain. К примеру: ``` site.com, Moscow, YANDEX LLC, Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) site2.com, Moscow, YANDEX LLC, Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) site3.com, Moscow, YANDEX LLC, Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) ``` Есть ли у кого-то идеи как это можно сделать? ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [March 12, 2020, 2:50pm UTC](https://discuss.elastic.co/t/topic/223294/2 "2020-03-12T14:50:12Z")
Вы не могли бы более подробно объяснить с примерами записей в формате json и примером желаемого результата? ---
**Author:** ![coolmac](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@coolmac](https://discuss.elastic.co/u/coolmac)\ **Post date:** [March 12, 2020, 3:24pm UTC](https://discuss.elastic.co/t/topic/223294/3 "2020-03-12T15:24:09Z")
Игорь, спасибо, что обратили внимание! Вот пример нескольких строк [https://pastebin.com/aSyNthE3](https://pastebin.com/aSyNthE3) (я удалил некоторые данные и некоторые заменил). Мы анализируем эти данные на предмет совпадения по трем параметрам: ``` source.geo.region_name source.as.organization.name user_agent.original ``` И возвращаем те строки, у которых эти данные совпадают. Как к примеру GROUP by field, в MySQL. В случае примеры мы должны получить последние два массива. ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [March 12, 2020, 8:20pm UTC](https://discuss.elastic.co/t/topic/223294/4 "2020-03-12T20:20:13Z")
Что должно вернуться из вашего примера? ---
**Author:** ![coolmac](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@coolmac](https://discuss.elastic.co/u/coolmac)\ **Post date:** [March 12, 2020, 8:56pm UTC](https://discuss.elastic.co/t/topic/223294/5 "2020-03-12T20:56:42Z")
Из моего примера должны вернутся 2 последних массива, вот эти [https://pastebin.com/mfWkFbd9](https://pastebin.com/mfWkFbd9) . Или я не понял ваш вопрос? ---
**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\ **Post date:** [March 13, 2020, 10:36pm UTC](https://discuss.elastic.co/t/topic/223294/6 "2020-03-13T22:36:47Z")
Можно как-то так, но это будет есть достаточно много памяти, если таких комбинаций параметров слишком много. Так что лучше будет создать отдельное поле, в котором все эти поля будут уже слиты, тогда можно будет убрать script и просто использовать это поле. ```auto DELETE test PUT test POST test/_bulk {"index":{}} {"destination":{"domain":"site.com"},"source":{"geo":{"continent_name":"Europe","region_iso_code":"RU-SPE","city_name":"St Petersburg","country_iso_code":"RU","region_name":"St.-Petersburg","location":{"lon":30.2642,"lat":59.8944}},"as":{"number":15378,"organization":{"name":"T2 Mobile LLC"}},"ip":"176.59.18.80"},"user_agent":{"original":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","os":{"name":"Windows 7"},"name":"Chrome","device":{"name":"Other"},"version":"41.0.2228"}} {"index":{}} {"destination":{"domain":"site.net"},"source":{"geo":{"continent_name":"Europe","country_iso_code":"RU","location":{"lon":37.6068,"lat":55.7386}},"as":{"number":31224,"organization":{"name":"PJSC MegaFon"}},"ip":"31.173.103.230"},"user_agent":{"original":"Mozilla/5.0 (Linux; arm_64; Android 7.1.1; ZC553KL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 YaBrowser/20.2.0.215.00 Mobile Safari/537.36","os":{"name":"Android","version":"7.1.1","full":"Android 7.1.1"},"name":"Yandex Browser","device":{"name":"Generic Smartphone"},"version":"20.2.0"}} {"index":{}} {"destination":{"domain":"site.ru"},"source":{"geo":{"continent_name":"Europe","region_iso_code":"CZ-10","city_name":"Prague","country_iso_code":"CZ","region_name":"Hlavni mesto Praha","location":{"lon":14.4667,"lat":50.0833}},"as":{"number":13335,"organization":{"name":"Cloudflare, Inc."}},"ip":"141.101.95.78"},"user_agent":{"original":"Mozilla/5.0 (compatible;Cloudflare-Healthchecks/1.0;+https://www.cloudflare.com/; healthcheck-id: 78a4266622fe6057)","name":"Other","device":{"name":"Other"}}} {"index":{}} {"destination":{"domain":"site.com"},"source":{"geo":{"continent_name":"North America","region_iso_code":"US-VA","city_name":"Ashburn","country_iso_code":"US","region_name":"Virginia","location":{"lon":-77.539,"lat":39.018}},"as":{"number":39572,"organization":{"name":"DataWeb Global Group B.V."}},"ip":"46.229.168.163"},"user_agent":{"original":"Mozilla/5.0 (compatible; SemrushBot/6~bl; +http://www.semrush.com/bot.html)","name":"SemrushBot","device":{"name":"Spider"},"version":"6"}} {"index":{}} {"destination":{"domain":"site.info"},"source":{"geo":{"continent_name":"North America","region_iso_code":"US-VA","city_name":"Ashburn","country_iso_code":"US","region_name":"Virginia","location":{"lon":-77.539,"lat":39.018}},"as":{"number":39572,"organization":{"name":"DataWeb Global Group B.V."}},"ip":"46.229.168.102"},"user_agent":{"original":"Mozilla/5.0 (compatible; SemrushBot/6~bl; +http://www.semrush.com/bot.html)","name":"SemrushBot","device":{"name":"Spider"},"version":"6"}} POST test/_search { "size": 0, "aggs": { "client": { "terms": { "script": { "source": "(doc['source.geo.region_name.keyword'].size() > 0 ? doc['source.geo.region_name.keyword'].value : 'N/A') + '|' + (doc['source.as.organization.name.keyword'].size() > 0 ? doc['source.as.organization.name.keyword'].value : 'N/A') + '|' + (doc['user_agent.original.keyword'].size() > 0 ? doc['user_agent.original.keyword'].value : 'N/A')", "lang": "painless" }, "min_doc_count": 2 }, "aggs": { "results": { "top_hits": { "size": 10 } }, "domain_count": { "cardinality": { "field": "destination.domain.keyword" } }, "sales_bucket_filter": { "bucket_selector": { "buckets_path": { "domainCount": "domain_count" }, "script": "params.domainCount > 1" } } } } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 10, 2020, 10:45pm UTC](https://discuss.elastic.co/t/topic/223294/7 "2020-04-10T22:45:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.