From 365bba468408deb35e673eb566165e5f8b7ea440 Mon Sep 17 00:00:00 2001 From: Andy Wick Date: Thu, 31 Aug 2023 12:01:57 -0400 Subject: [PATCH] add dns rr https parsing (#2360) --- capture/parsers/dns.c | 97 ++++++++++++++++++++++++++++++++- capture/parsers/dns.detail.jade | 4 ++ tests/api-buildquery.t | 24 ++++---- tests/api-multies.t | 2 +- 4 files changed, 113 insertions(+), 14 deletions(-) diff --git a/capture/parsers/dns.c b/capture/parsers/dns.c index 6718e92e02..d028d7de60 100644 --- a/capture/parsers/dns.c +++ b/capture/parsers/dns.c @@ -32,6 +32,9 @@ LOCAL int queryTypeField; LOCAL int queryClassField; LOCAL int statusField; LOCAL int opCodeField; +LOCAL int httpsAlpnField; +LOCAL int httpsPortField; +LOCAL int httpsIpField; typedef enum dns_type { @@ -39,7 +42,8 @@ typedef enum dns_type RR_NS = 2, RR_CNAME = 5, RR_MX = 15, - RR_AAAA = 28 + RR_AAAA = 28, + RR_HTTPS = 65 } DNSType_t; typedef enum dns_class @@ -206,6 +210,73 @@ LOCAL int dns_find_host(int pos, MolochSession_t *session, char *string, int len return FALSE; } /******************************************************************************/ +LOCAL void dns_parser_rr_https(MolochSession_t *session, const unsigned char *data, int len) +{ + if (len < 10) + return; + + BSB bsb; + BSB_INIT(bsb, data, len); + + BSB_IMPORT_skip(bsb, 2); // priority + uint8_t name = 1; + BSB_IMPORT_u08(bsb, name); + if (name != 0) // ALW - Can this be a real name? + return; + + while (BSB_REMAINING(bsb) > 4 && !BSB_IS_ERROR(bsb)) { + uint16_t key = 0; + BSB_IMPORT_u16(bsb, key); + uint16_t len = 0; + BSB_IMPORT_u16(bsb, len); + + if (len > BSB_REMAINING(bsb)) + return; + + unsigned char *ptr = BSB_WORK_PTR(bsb); + + switch (key) { + case 1: { // alpn + BSB absb; + BSB_INIT(absb, ptr, len); + while (BSB_REMAINING(absb) > 1 && !BSB_IS_ERROR(absb)) { + uint8_t alen = 0; + BSB_IMPORT_u08(absb, alen); + + unsigned char *aptr = NULL; + BSB_IMPORT_ptr(absb, aptr, alen); + + if (aptr) { + moloch_field_string_add(httpsAlpnField, session, (char *)aptr, alen, TRUE); + } + } + break; + } + case 3: { // port + if (len != 2) + break; + uint16_t port = (ptr[0] << 8) | ptr[1]; + moloch_field_int_add(httpsPortField, session, port); + break; + } + case 4: { // ipv4hint + if (len != 4) + break; + uint32_t ip = (ptr[3] << 24) | (ptr[2] << 16) | (ptr[1] << 8) | ptr[0]; + moloch_field_ip4_add(httpsIpField, session, ip); + break; + } + case 6: // ipv6hint + if (len != 16) + break; + moloch_field_ip6_add(httpsIpField, session, ptr); + break; + } + BSB_IMPORT_skip(bsb, len); + } + +} +/******************************************************************************/ LOCAL void dns_parser(MolochSession_t *session, int kind, const unsigned char *data, int len) { @@ -432,6 +503,10 @@ LOCAL void dns_parser(MolochSession_t *session, int kind, const unsigned char *d } break; } + case RR_HTTPS: { + dns_parser_rr_https(session, BSB_WORK_PTR(bsb), rdlength); + break; + } } /* switch */ BSB_IMPORT_skip(bsb, rdlength); } @@ -614,6 +689,26 @@ void moloch_parser_init() MOLOCH_FIELD_TYPE_STR_HASH, MOLOCH_FIELD_FLAG_CNT, (char *)NULL); + httpsAlpnField = moloch_field_define("dns", "lotermfield", + "dns.https.alpn", "Alpn", "dns.https.alpn", + "DNS https alpn", + MOLOCH_FIELD_TYPE_STR_HASH, MOLOCH_FIELD_FLAG_CNT, + (char *)NULL); + + httpsIpField = moloch_field_define("dns", "ip", + "ip.dns.https", "IP", "dns.https.ip", + "DNS https ip", + MOLOCH_FIELD_TYPE_IP_GHASH, MOLOCH_FIELD_FLAG_CNT | MOLOCH_FIELD_FLAG_IPPRE, + "aliases", "[\"dns.https.ip\"]", + "category", "ip", + (char *)NULL); + + httpsPortField = moloch_field_define("dns", "integer", + "dns.https.port", "IP", "dns.https.port", + "DNS https port", + MOLOCH_FIELD_TYPE_INT_HASH, MOLOCH_FIELD_FLAG_CNT, + (char *)NULL); + qclasses[1] = "IN"; qclasses[2] = "CS"; qclasses[3] = "CH"; diff --git a/capture/parsers/dns.detail.jade b/capture/parsers/dns.detail.jade index 3005b650d2..f2816fd7c6 100644 --- a/capture/parsers/dns.detail.jade +++ b/capture/parsers/dns.detail.jade @@ -54,3 +54,7 @@ if (session.dns) +arrayList(session.dns, 'status', "Status Code", "dns.status") +arrayList(session.dns, 'qt', "Query Type", "dns.query.type") +arrayList(session.dns, 'qc', "Query Class", "dns.query.class") + if (session.dns.https) + +arrayList(session.dns.https, 'alpn', "HTTPS ALPN", "dns.https.alpn") + +arrayList(session.dns.https, 'port', "HTTPS Port", "dns.https.port") + +ipArrayList(session.dns.https, "ip", "HTTPS IPs", "dns.https") diff --git a/tests/api-buildquery.t b/tests/api-buildquery.t index c62c80c960..2000b79e89 100644 --- a/tests/api-buildquery.t +++ b/tests/api-buildquery.t @@ -130,26 +130,26 @@ doTest('ip.src == 1:2:3.80', qq({"bool":{"filter":[{"term":{"source.ip":"1:2:3:: #### IP -doTest('ip == 1.2.3.4', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); -doTest('ip != 1.2.3.4', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); +doTest('ip == 1.2.3.4', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); +doTest('ip != 1.2.3.4', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); doTest('ip == 1.2.3.4:80', '{"bool":{"should":[{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.4"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.4"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.4"}},{"term":{"source.port":"80"}}]}}]}}'); doTest('ip != 1.2.3.4:80', '{"bool":{"must_not":[{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.4"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.4"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.4"}},{"term":{"source.port":"80"}}]}}]}}'); -doTest('ip == [1.2.3.4]', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); -doTest('ip != [1.2.3.4]', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); +doTest('ip == [1.2.3.4]', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); +doTest('ip != [1.2.3.4]', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}}]}}'); -doTest('ip == [1.2.3.4,2.3.4.5:80,:81,1.2.3:82]', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}},{"bool":{"filter":[{"term":{"destination.ip":"2.3.4.5"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"2.3.4.5"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"2.3.4.5"}},{"term":{"source.port":"80"}}]}},{"term":{"destination.port":"81"}},{"term":{"socks.port":"81"}},{"term":{"source.port":"81"}},{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.0/24"}},{"term":{"destination.port":"82"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.0/24"}},{"term":{"socks.port":"82"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.0/24"}},{"term":{"source.port":"82"}}]}}]}}'); -doTest('ip != [1.2.3.4,2.3.4.5:80,:81,1.2.3:82]', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}},{"bool":{"filter":[{"term":{"destination.ip":"2.3.4.5"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"2.3.4.5"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"2.3.4.5"}},{"term":{"source.port":"80"}}]}},{"term":{"destination.port":"81"}},{"term":{"socks.port":"81"}},{"term":{"source.port":"81"}},{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.0/24"}},{"term":{"destination.port":"82"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.0/24"}},{"term":{"socks.port":"82"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.0/24"}},{"term":{"source.port":"82"}}]}}]}}'); +doTest('ip == [1.2.3.4,2.3.4.5:80,:81,1.2.3:82]', '{"bool":{"should":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}},{"bool":{"filter":[{"term":{"destination.ip":"2.3.4.5"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"2.3.4.5"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"2.3.4.5"}},{"term":{"source.port":"80"}}]}},{"term":{"destination.port":"81"}},{"term":{"socks.port":"81"}},{"term":{"source.port":"81"}},{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.0/24"}},{"term":{"destination.port":"82"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.0/24"}},{"term":{"socks.port":"82"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.0/24"}},{"term":{"source.port":"82"}}]}}]}}'); +doTest('ip != [1.2.3.4,2.3.4.5:80,:81,1.2.3:82]', '{"bool":{"must_not":[{"term":{"dns.ip":"1.2.3.4"}},{"term":{"dnsipall":"1.2.3.4"}},{"term":{"dns.https.ip":"1.2.3.4"}},{"term":{"dns.mailserverIp":"1.2.3.4"}},{"term":{"dns.nameserverIp":"1.2.3.4"}},{"term":{"destination.ip":"1.2.3.4"}},{"term":{"email.ip":"1.2.3.4"}},{"term":{"socks.ip":"1.2.3.4"}},{"term":{"source.ip":"1.2.3.4"}},{"term":{"http.xffIp":"1.2.3.4"}},{"term":{"dstOuterIp":"1.2.3.4"}},{"term":{"srcOuterIp":"1.2.3.4"}},{"term":{"radius.endpointIp":"1.2.3.4"}},{"term":{"radius.framedIp":"1.2.3.4"}},{"term":{"test.ip":"1.2.3.4"}},{"bool":{"filter":[{"term":{"destination.ip":"2.3.4.5"}},{"term":{"destination.port":"80"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"2.3.4.5"}},{"term":{"socks.port":"80"}}]}},{"bool":{"filter":[{"term":{"source.ip":"2.3.4.5"}},{"term":{"source.port":"80"}}]}},{"term":{"destination.port":"81"}},{"term":{"socks.port":"81"}},{"term":{"source.port":"81"}},{"bool":{"filter":[{"term":{"destination.ip":"1.2.3.0/24"}},{"term":{"destination.port":"82"}}]}},{"bool":{"filter":[{"term":{"socks.ip":"1.2.3.0/24"}},{"term":{"socks.port":"82"}}]}},{"bool":{"filter":[{"term":{"source.ip":"1.2.3.0/24"}},{"term":{"source.port":"82"}}]}}]}}'); -doTest('ip == $ipshortcut1', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); -doTest('ip != $ipshortcut1', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); +doTest('ip == $ipshortcut1', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); +doTest('ip != $ipshortcut1', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); -doTest('ip == [$ipshortcut1]', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); -doTest('ip != [$ipshortcut1]', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); +doTest('ip == [$ipshortcut1]', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); +doTest('ip != [$ipshortcut1]', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}}]}})); -doTest('ip == [$ipshortcut1,$ipshortcut2]', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"srcOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dnsipall":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dns.mailserverIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dns.nameserverIp":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"destination.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"email.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"socks.ip":{"path":"ip","index":"tests_lookups","id":"$ipshortcut2"}}},{"terms":{"source.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"test.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}}]}})); -doTest('ip != [$ipshortcut1,$ipshortcut2]', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"srcOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dnsipall":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dns.mailserverIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dns.nameserverIp":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"destination.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"email.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"socks.ip":{"path":"ip","index":"tests_lookups","id":"$ipshortcut2"}}},{"terms":{"source.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"test.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}}]}})); +doTest('ip == [$ipshortcut1,$ipshortcut2]', qq({"bool":{"should":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"srcOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dnsipall":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dns.nameserverIp":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"destination.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"email.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"socks.ip":{"path":"ip","index":"tests_lookups","id":"$ipshortcut2"}}},{"terms":{"source.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"test.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}}]}})); +doTest('ip != [$ipshortcut1,$ipshortcut2]', qq({"bool":{"must_not":[{"terms":{"dns.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut1"}}},{"terms":{"dnsipall":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.nameserverIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"destination.ip":{"path":"ip","id":"$ipshortcut1","index":"tests_lookups"}}},{"terms":{"email.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"socks.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"source.ip":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dstOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"srcOuterIp":{"id":"$ipshortcut1","index":"tests_lookups","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut1","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"test.ip":{"index":"tests_lookups","id":"$ipshortcut1","path":"ip"}}},{"terms":{"dns.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dnsipall":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"dns.https.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"dns.mailserverIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dns.nameserverIp":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"destination.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"email.ip":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"socks.ip":{"path":"ip","index":"tests_lookups","id":"$ipshortcut2"}}},{"terms":{"source.ip":{"id":"$ipshortcut2","index":"tests_lookups","path":"ip"}}},{"terms":{"http.xffIp":{"index":"tests_lookups","path":"ip","id":"$ipshortcut2"}}},{"terms":{"dstOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"srcOuterIp":{"index":"tests_lookups","id":"$ipshortcut2","path":"ip"}}},{"terms":{"radius.endpointIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"radius.framedIp":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}},{"terms":{"test.ip":{"id":"$ipshortcut2","path":"ip","index":"tests_lookups"}}}]}})); #### host.http diff --git a/tests/api-multies.t b/tests/api-multies.t index 40f045a7b3..a04bf53a05 100644 --- a/tests/api-multies.t +++ b/tests/api-multies.t @@ -84,7 +84,7 @@ my $json; $json = mesPost("/MULTIPREFIX_fields/_search?rest_total_hits_as_int=true", "{\"size\":1000}"); cmp_ok($json->{hits}->{total}, '>=', 190, "fields count is at least 190"); - cmp_ok($json->{hits}->{total}, '<', 400, "fields count is less then 400"); + cmp_ok($json->{hits}->{total}, '<', 450, "fields count is less then 450"); is ($json->{hits}->{hits}->[0]->{_index}, "MULTIPREFIX_fields_v30", "Correct fields index name"); $json = mesGet("/MULTIPREFIX_sessions3-141015/_search?preference=primary_first&ignore_unavailable=true&rest_total_hits_as_int=true");