SigmaHQ / pySigma-backend-elasticsearch

pySigma Elasticsearch backend
GNU Lesser General Public License v3.0
42 stars 26 forks source link

Fix: Feature not supported on fieldref modifier #64

Closed andurin closed 4 months ago

andurin commented 4 months ago

As @defensivedepth recognized there is an upcoming modifier called "fieldref" which aims to use a field reference for comparision.

As far as I know:

FTR - it could be something like this:

{
  "query": {
    "bool": {
      "must": [
        {
          "script": {
            "script": {
              "source": "doc['field1'].value > doc['field2'].value"
            }
          }
        }
      ]
    }
  }
}

But this may be a expensive search since the script will be applied to each document within the index.