示例：通过将值与范围匹配来丰富数据
编辑示例：通过将值与范围匹配来丰富数据
编辑range 富集策略 使用 term 查询，将传入文档中的数字、日期或 IP 地址与富集索引中相同类型的范围进行匹配。不支持将范围与范围进行匹配。
以下示例创建一个 range 富集策略，该策略基于 IP 地址向传入文档添加描述性网络名称和负责部门。然后，它将富集策略添加到 Ingest 管线中的处理器。
使用 创建索引 API 和适当的映射来创建源索引。
resp = client.indices.create(
index="networks",
mappings={
"properties": {
"range": {
"type": "ip_range"
},
"name": {
"type": "keyword"
},
"department": {
"type": "keyword"
}
}
},
)
print(resp)
response = client.indices.create(
index: 'networks',
body: {
mappings: {
properties: {
range: {
type: 'ip_range'
},
name: {
type: 'keyword'
},
department: {
type: 'keyword'
}
}
}
}
)
puts response
const response = await client.indices.create({
index: "networks",
mappings: {
properties: {
range: {
type: "ip_range",
},
name: {
type: "keyword",
},
department: {
type: "keyword",
},
},
},
});
console.log(response);
PUT /networks
{
"mappings": {
"properties": {
"range": { "type": "ip_range" },
"name": { "type": "keyword" },
"department": { "type": "keyword" }
}
}
}
以下索引 API 请求将新文档索引到该索引。
resp = client.index(
index="networks",
id="1",
refresh="wait_for",
document={
"range": "10.100.0.0/16",
"name": "production",
"department": "OPS"
},
)
print(resp)
response = client.index(
index: 'networks',
id: 1,
refresh: 'wait_for',
body: {
range: '10.100.0.0/16',
name: 'production',
department: 'OPS'
}
)
puts response
const response = await client.index({
index: "networks",
id: 1,
refresh: "wait_for",
document: {
range: "10.100.0.0/16",
name: "production",
department: "OPS",
},
});
console.log(response);
PUT /networks/_doc/1?refresh=wait_for
{
"range": "10.100.0.0/16",
"name": "production",
"department": "OPS"
}
使用创建富集策略 API 创建一个 range 策略类型的富集策略。此策略必须包括：
- 一个或多个源索引
match_field，即用于匹配传入文档的源索引中的字段- 您想附加到传入文档的源索引中的富集字段
由于我们计划基于 IP 地址丰富文档，因此该策略的 match_field 必须是一个 ip_range 字段。
resp = client.enrich.put_policy(
name="networks-policy",
range={
"indices": "networks",
"match_field": "range",
"enrich_fields": [
"name",
"department"
]
},
)
print(resp)
response = client.enrich.put_policy(
name: 'networks-policy',
body: {
range: {
indices: 'networks',
match_field: 'range',
enrich_fields: [
'name',
'department'
]
}
}
)
puts response
const response = await client.enrich.putPolicy({
name: "networks-policy",
range: {
indices: "networks",
match_field: "range",
enrich_fields: ["name", "department"],
},
});
console.log(response);
PUT /_enrich/policy/networks-policy
{
"range": {
"indices": "networks",
"match_field": "range",
"enrich_fields": ["name", "department"]
}
}
使用 执行富集策略 API 为策略创建富集索引。
POST /_enrich/policy/networks-policy/_execute?wait_for_completion=false
使用 创建或更新管线 API 创建 Ingest 管线。在管线中，添加一个 富集处理器，其中包括：
- 您的富集策略。
- 用于匹配富集索引中文档的传入文档的
field。 - 用于存储传入文档的附加富集数据的
target_field。此字段包含您在富集策略中指定的match_field和enrich_fields。
resp = client.ingest.put_pipeline(
id="networks_lookup",
processors=[
{
"enrich": {
"description": "Add 'network' data based on 'ip'",
"policy_name": "networks-policy",
"field": "ip",
"target_field": "network",
"max_matches": "10"
}
}
],
)
print(resp)
const response = await client.ingest.putPipeline({
id: "networks_lookup",
processors: [
{
enrich: {
description: "Add 'network' data based on 'ip'",
policy_name: "networks-policy",
field: "ip",
target_field: "network",
max_matches: "10",
},
},
],
});
console.log(response);
PUT /_ingest/pipeline/networks_lookup
{
"processors" : [
{
"enrich" : {
"description": "Add 'network' data based on 'ip'",
"policy_name": "networks-policy",
"field" : "ip",
"target_field": "network",
"max_matches": "10"
}
}
]
}
使用 Ingest 管线来索引文档。传入文档应包括在您的富集处理器中指定的 field。
resp = client.index(
index="my-index-000001",
id="my_id",
pipeline="networks_lookup",
document={
"ip": "10.100.34.1"
},
)
print(resp)
const response = await client.index({
index: "my-index-000001",
id: "my_id",
pipeline: "networks_lookup",
document: {
ip: "10.100.34.1",
},
});
console.log(response);
PUT /my-index-000001/_doc/my_id?pipeline=networks_lookup
{
"ip": "10.100.34.1"
}
要验证富集处理器是否匹配并附加了相应的字段数据，请使用 get API 查看索引的文档。
resp = client.get(
index="my-index-000001",
id="my_id",
)
print(resp)
response = client.get( index: 'my-index-000001', id: 'my_id' ) puts response
const response = await client.get({
index: "my-index-000001",
id: "my_id",
});
console.log(response);
GET /my-index-000001/_doc/my_id
API 返回以下响应：
{
"_index" : "my-index-000001",
"_id" : "my_id",
"_version" : 1,
"_seq_no" : 0,
"_primary_term" : 1,
"found" : true,
"_source" : {
"ip" : "10.100.34.1",
"network" : [
{
"name" : "production",
"range" : "10.100.0.0/16",
"department" : "OPS"
}
]
}
}