add response_code_filter parameter in auditing events search api

This commit is contained in:
wanjunlei
2020-06-04 12:06:56 +08:00
parent 1882b20e6e
commit 3d3b9d5af5
7 changed files with 172 additions and 14 deletions

View File

@@ -361,10 +361,10 @@ func parseToQueryPart(f *auditing.Filter) interface{} {
}
}
if f.ResponseStatus != nil && len(f.ResponseStatus) > 0 {
if f.ResponseCodes != nil && len(f.ResponseCodes) > 0 {
bi := BoolBody{MinimumShouldMatch: &mini}
for _, v := range f.ResponseStatus {
for _, v := range f.ResponseCodes {
bi.Should = append(bi.Should, map[string]interface{}{
"term": map[string]int32{"ResponseStatus.code": v},
})
@@ -373,6 +373,13 @@ func parseToQueryPart(f *auditing.Filter) interface{} {
b.Filter = append(b.Filter, map[string]interface{}{"bool": bi})
}
if len(f.ResponseStatus) > 0 {
if bi := shouldBoolbody("match_phrase", "ResponseStatus.status",
f.ResponseStatus, nil); bi != nil {
b.Filter = append(b.Filter, map[string]interface{}{"bool": bi})
}
}
if f.StartTime != nil || f.EndTime != nil {
m := make(map[string]*time.Time)
if f.StartTime != nil {