diff --git a/apps/terminal/backends/command/es.py b/apps/terminal/backends/command/es.py index ab7e59414..1248f2a32 100644 --- a/apps/terminal/backends/command/es.py +++ b/apps/terminal/backends/command/es.py @@ -11,7 +11,7 @@ from django.utils.translation import gettext_lazy as _ from django.db.models import QuerySet as DJQuerySet from elasticsearch import Elasticsearch from elasticsearch.helpers import bulk -from elasticsearch.exceptions import RequestError +from elasticsearch.exceptions import RequestError, NotFoundError from common.utils.common import lazyproperty from common.utils import get_logger @@ -40,24 +40,35 @@ class CommandStore(): if ignore_verify_certs: kwargs['verify_certs'] = None self.es = Elasticsearch(hosts=hosts, max_retries=0, **kwargs) - self.is_new_index_type() + + self.exact_fields = set() + self.match_fields = {'input', 'risk_level', 'user', 'asset', 'system_user'} + may_exact_fields = {'session', 'org_id'} + + if self.is_new_index_type(): + self.exact_fields.update(may_exact_fields) + self.doc_type = '_doc' + else: + self.match_fields.update(may_exact_fields) def is_new_index_type(self): - # 检测索引是不是新的类型 - data = self.es.indices.get_mapping(self.index) + if not self.ping(timeout=3): + return False + + try: + # 获取索引信息,如果没有定义,直接返回 + data = self.es.indices.get_mapping(self.index) + except NotFoundError: + return False + try: + # 检测索引是不是新的类型 properties = data[self.index]['mappings']['properties'] if properties['session']['type'] == 'keyword' \ and properties['org_id']['type'] == 'keyword': - self.exact_fields = {'session', 'org_id'} - self.match_fields = {'input', 'org_id', 'risk_level', 'user', 'asset', 'system_user'} - self.doc_type = '_doc' - return + return True except KeyError: - pass - - self.exact_fields = {} - self.match_fields = {'session', 'org_id', 'input', 'org_id', 'risk_level', 'user', 'asset', 'system_user'} + return False def pre_use_check(self): if not self.ping(timeout=3): diff --git a/apps/terminal/serializers/storage.py b/apps/terminal/serializers/storage.py index d0f803928..61c018b37 100644 --- a/apps/terminal/serializers/storage.py +++ b/apps/terminal/serializers/storage.py @@ -153,7 +153,7 @@ class CommandStorageTypeESSerializer(serializers.Serializer): INDEX = serializers.CharField( max_length=1024, default='jumpserver', label=_('Index'), allow_null=True ) - DOC_TYPE = ReadableHiddenField(default='command', label=_('Doc type'), allow_null=True) + DOC_TYPE = ReadableHiddenField(default='_doc', label=_('Doc type'), allow_null=True) IGNORE_VERIFY_CERTS = serializers.BooleanField( default=False, label=_('Ignore Certificate Verification'), source='OTHER.IGNORE_VERIFY_CERTS', allow_null=True,