sample-log

# IDS log
{
  "src_ip": "10.0.0.1",
  "log_level": "critical",
  "type": "ids"
},
{
  "src_ip": "10.0.0.2",
  "log_level": "info",
  "type": "ids"
},
{
  "src_ip": "10.0.0.3",
  "log_level": "critical",
  "type": "ids"
}

# IIS log
{
  "src_ip": "10.0.0.1",
  "http_status": 200,
  "path": "/admin.aspx",
  "type": "iis"
},
{
  "src_ip": "10.0.0.2",
  "http_status": 200,
  "path": "/admin.aspx",
  "type": "iis"
}

#######
Find the IPs that have log_level:critical on IDS and path:"/admin.aspx" && http_status:200 on IIS


# Combine IDS and IIS. This returns 10.0.0.3 which is not what I am looking for
POST test/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must": [
              {
                "match": {
                  "log_level": "critical"
                }
              },
              {
                "match": {
                  "type": "ids"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "must": [
              {
                "match": {
                  "path": "/admin.aspx"
                }
              },
              {
                "match": {
                  "type": "iis"
                }
              },
              {
                "match": {
                  "http_status": 200
                }
              }
            ]
          }
        }
      ]
    }
  },
  "aggs": {
    "ip": {
      "terms": {
        "field": "src_ip",
        "size": 10
      }
    }
  }