New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
« 示例：基于精确值丰富数据 Ingest 处理器参考 »
Elastic 文档 ›Elasticsearch 指南 [8.17] ›Ingest 管线 ›丰富您的数据

示例：通过将值与范围匹配来丰富数据

编辑

示例：通过将值与范围匹配来丰富数据

编辑

range 富集策略 使用 term 查询，将传入文档中的数字、日期或 IP 地址与富集索引中相同类型的范围进行匹配。不支持将范围与范围进行匹配。

以下示例创建一个 range 富集策略，该策略基于 IP 地址向传入文档添加描述性网络名称和负责部门。然后，它将富集策略添加到 Ingest 管线中的处理器。

使用 创建索引 API 和适当的映射来创建源索引。

resp = client.indices.create(
    index="networks",
    mappings={
        "properties": {
            "range": {
                "type": "ip_range"
            },
            "name": {
                "type": "keyword"
            },
            "department": {
                "type": "keyword"
            }
        }
    },
)
print(resp)
response = client.indices.create(
  index: 'networks',
  body: {
    mappings: {
      properties: {
        range: {
          type: 'ip_range'
        },
        name: {
          type: 'keyword'
        },
        department: {
          type: 'keyword'
        }
      }
    }
  }
)
puts response
const response = await client.indices.create({
  index: "networks",
  mappings: {
    properties: {
      range: {
        type: "ip_range",
      },
      name: {
        type: "keyword",
      },
      department: {
        type: "keyword",
      },
    },
  },
});
console.log(response);
PUT /networks
{
  "mappings": {
    "properties": {
      "range": { "type": "ip_range" },
      "name": { "type": "keyword" },
      "department": { "type": "keyword" }
    }
  }
}
Copy as curlTry in Elastic 

以下索引 API 请求将新文档索引到该索引。

resp = client.index(
    index="networks",
    id="1",
    refresh="wait_for",
    document={
        "range": "10.100.0.0/16",
        "name": "production",
        "department": "OPS"
    },
)
print(resp)
response = client.index(
  index: 'networks',
  id: 1,
  refresh: 'wait_for',
  body: {
    range: '10.100.0.0/16',
    name: 'production',
    department: 'OPS'
  }
)
puts response
const response = await client.index({
  index: "networks",
  id: 1,
  refresh: "wait_for",
  document: {
    range: "10.100.0.0/16",
    name: "production",
    department: "OPS",
  },
});
console.log(response);
PUT /networks/_doc/1?refresh=wait_for
{
  "range": "10.100.0.0/16",
  "name": "production",
  "department": "OPS"
}
Copy as curlTry in Elastic 

使用创建富集策略 API 创建一个 range 策略类型的富集策略。此策略必须包括：

  • 一个或多个源索引
  • match_field，即用于匹配传入文档的源索引中的字段
  • 您想附加到传入文档的源索引中的富集字段

由于我们计划基于 IP 地址丰富文档，因此该策略的 match_field 必须是一个 ip_range 字段。

resp = client.enrich.put_policy(
    name="networks-policy",
    range={
        "indices": "networks",
        "match_field": "range",
        "enrich_fields": [
            "name",
            "department"
        ]
    },
)
print(resp)
response = client.enrich.put_policy(
  name: 'networks-policy',
  body: {
    range: {
      indices: 'networks',
      match_field: 'range',
      enrich_fields: [
        'name',
        'department'
      ]
    }
  }
)
puts response
const response = await client.enrich.putPolicy({
  name: "networks-policy",
  range: {
    indices: "networks",
    match_field: "range",
    enrich_fields: ["name", "department"],
  },
});
console.log(response);
PUT /_enrich/policy/networks-policy
{
  "range": {
    "indices": "networks",
    "match_field": "range",
    "enrich_fields": ["name", "department"]
  }
}
Copy as curlTry in Elastic 

使用 执行富集策略 API 为策略创建富集索引。

POST /_enrich/policy/networks-policy/_execute?wait_for_completion=false
Copy as curlTry in Elastic 

使用 创建或更新管线 API 创建 Ingest 管线。在管线中，添加一个 富集处理器，其中包括：

  • 您的富集策略。
  • 用于匹配富集索引中文档的传入文档的 field。
  • 用于存储传入文档的附加富集数据的 target_field。此字段包含您在富集策略中指定的 match_field 和 enrich_fields。
resp = client.ingest.put_pipeline(
    id="networks_lookup",
    processors=[
        {
            "enrich": {
                "description": "Add 'network' data based on 'ip'",
                "policy_name": "networks-policy",
                "field": "ip",
                "target_field": "network",
                "max_matches": "10"
            }
        }
    ],
)
print(resp)
const response = await client.ingest.putPipeline({
  id: "networks_lookup",
  processors: [
    {
      enrich: {
        description: "Add 'network' data based on 'ip'",
        policy_name: "networks-policy",
        field: "ip",
        target_field: "network",
        max_matches: "10",
      },
    },
  ],
});
console.log(response);
PUT /_ingest/pipeline/networks_lookup
{
  "processors" : [
    {
      "enrich" : {
        "description": "Add 'network' data based on 'ip'",
        "policy_name": "networks-policy",
        "field" : "ip",
        "target_field": "network",
        "max_matches": "10"
      }
    }
  ]
}
Copy as curlTry in Elastic 

使用 Ingest 管线来索引文档。传入文档应包括在您的富集处理器中指定的 field。

resp = client.index(
    index="my-index-000001",
    id="my_id",
    pipeline="networks_lookup",
    document={
        "ip": "10.100.34.1"
    },
)
print(resp)
const response = await client.index({
  index: "my-index-000001",
  id: "my_id",
  pipeline: "networks_lookup",
  document: {
    ip: "10.100.34.1",
  },
});
console.log(response);
PUT /my-index-000001/_doc/my_id?pipeline=networks_lookup
{
  "ip": "10.100.34.1"
}
Copy as curlTry in Elastic 

要验证富集处理器是否匹配并附加了相应的字段数据，请使用 get API 查看索引的文档。

resp = client.get(
    index="my-index-000001",
    id="my_id",
)
print(resp)
response = client.get(
  index: 'my-index-000001',
  id: 'my_id'
)
puts response
const response = await client.get({
  index: "my-index-000001",
  id: "my_id",
});
console.log(response);
GET /my-index-000001/_doc/my_id
Copy as curlTry in Elastic 

API 返回以下响应：

{
  "_index" : "my-index-000001",
  "_id" : "my_id",
  "_version" : 1,
  "_seq_no" : 0,
  "_primary_term" : 1,
  "found" : true,
  "_source" : {
    "ip" : "10.100.34.1",
    "network" : [
      {
        "name" : "production",
        "range" : "10.100.0.0/16",
        "department" : "OPS"
      }
    ]
  }
}
« 示例：基于精确值丰富数据 Ingest 处理器参考 »
Was this helpful?
Feedback