0

I have the following document in a mongodb collection which represents a Snort rule parsed with the perl Parse::Snort library:

{
"_id" : ObjectId("5328b974be4ed1400900000a"),
"dst_port" : "6000",
"opts" : [ 
    [ 
        "msg", 
        "\"X11 xopen\""
    ], 
    [ 
        "flow", 
        "established"
    ], 
    [ 
        "content", 
        "\"l|00 0B 00 00 00 00 00 00 00 00 00|\""
    ], 
    [ 
        "fast_pattern", 
        "only"
    ], 
    [ 
        "metadata", 
        "ruleset community"
    ], 
    [ 
        "classtype", 
        "unknown"
    ], 
    [ 
        "sid", 
        "1226"
    ], 
    [ 
        "rev", 
        "10"
    ], 
    [ 
        "gid", 
        "1"
    ]
],
"proto" : "tcp",
"direction" : "->",
"src" : "$EXTERNAL_NET",
"update" : "0",
"action" : "alert",
"dst" : "$HOME_NET",
"src_port" : "any"
}

I am trying to search all documents in this collection with opts.sid=1226,opts.gid=1 and opts.rev=10.

With the following line I am able to find all documents with sid=1226:

db.rules.find({"opts":{"$elemMatch":{"$all":["sid","1226"]}}});

But I can't figure out how to search filtering more fields such as ["gid","1"] and ["rev","10"]
Does anyone know how I can add the extra conditions?

1 Answer 1

0

You can use $all directly on the opts field to do this:

db.rules.find({opts: {$all: [['sid', '1226'], ['gid', '1'], ['rev', '10']]}})

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.