我有这样的文件:
{
"si" : "10.131.6.79",
"sp" : 36158,
"n" : "snat",
"tsi" : "194.230.159.203",
"tsp" : 36158,
"di" : "205.185.208.165",
"dp" : 443
}
{
"si" : "10.128.103.115",
"sp" : 56261,
"n" : "dnat",
"tdi" : "194.230.159.107",
"tdp" : 56261,
"di" : "8.253.207.243",
"dp" : 443
}
而且我想查询将多个匹配结果串联在一起的情况。期望的结果是
{
"sourceIp" : "10.131.6.79",
"sourcePort" : 36158,
"trandisp" : "snat",
"sourceNatIp" : "194.230.159.203",
"sourceNatPort" : 36158,
"destIp" : "205.185.208.165",
"dp" : 443
}
{
"sourceIp" : "10.128.103.115",
"sourcePort" : 56261,
"trandisp" : "dnat",
"destinationNatIp" : "194.230.159.107",
"destinationNatPort" : 56261,
"destIp" : "8.253.207.243",
"destPort" : 443
}
原则上,我使用此命令对其进行管理:
{ $concatArrays: [
db.sessions.aggregate([
{$match:{n:"snat"}},
{$project : {
_id : 0,sourceIp : "$si",sourcePort : "$sp",sourceNatIp : "$tsi",sourceNatPort : "$tsp", destIp : "$di",destPort : "$dp", trandisp: "$n"
}}
]),
db.sessions.aggregate([
{$match:{n:"dnat"}},
{$project : {
_id : 0,sourceIp : "$si",sourcePort : "$sp",destinationNatIp : "$tdi",destinationNatPort : "$tdp", destIp : "$di",destPort : "$dp" ,trandisp: "$n"
}}
])
] }
但是我需要它作为查询结果,即我想创建一个视图。
在SQL中,我会写
select
si as SourceIp, sp as SourcePort, n as transdisp,
tsi as SourceNatIp, tsp as SouceNatPort,
null as DestinationNatIp, null as DestinationNatPort
from sessions
where n = 'snat'
union all
select
si as SourceIp, sp as SourcePort, n as transdisp,
null as SourceNatIp, null as SouceNatPort,
tdi as DestinationNatIp, tdp as DestinationNatPort
from sessions
where n = 'dnat';
您可以尝试看看$facet运算符,该运算符使您可以运行多个单独的查询并以单个文档的形式获取结果。然后,您可以运行$concatArrays,$unwind和$replaceRoot组合并提升查询结果。
db.sessions.aggregate([
{
$facet: {
q1: [
{ $match:{n:"snat"} },
{ $project : {
_id : 0,sourceIp : "$si",sourcePort : "$sp",sourceNatIp : "$tsi",sourceNatPort : "$tsp", destIp : "$di",destPort : "$dp", trandisp: "$n"
}}
],
q2: [
{ $match:{n:"dnat"}},
{ $project : {
_id : 0,sourceIp : "$si",sourcePort : "$sp",destinationNatIp : "$tdi",destinationNatPort : "$tdp", destIp : "$di",destPort : "$dp" ,trandisp: "$n"
}}
]
}
},
{
$project: {
all: {
$concatArrays: [ "$q1", "$q2" ]
}
}
},
{
$unwind: "$all"
},
{
$replaceRoot: {
newRoot: "$all"
}
}
])