Indexy:

"indexes": {
	"ts": {"fields": [{"ts": 1}], "background": 1},
	"ts_u": {"fields": [{"ts_u": 1}], "background": 1},
	"node_name": {"fields": [{"Node.Name": 1}], "background": 1},
	"node_sw": {"fields": [{"Node.SW": 1}], "background": 1},
	"category": {"fields": [{"Category": 1}], "background": 1},
	"description": {"fields": [{"Description": 1}], "background": 1},
	"detector": {"fields": [{"Node.Name": 1}, {"Node.SW": 1}], "background": 1},
	"createtime": {"fields": [{"CreateTime": -1}], "background": 1},
	"detecttime": {"fields": [{"DetectTime": -1}], "background": 1},
	"source_ip4": {"fields": [{"Source.IP4.ip": 1}], "background": 1},
	"target_ip4": {"fields": [{"Target.IP4.ip": 1}], "background": 1},
	"source_ip4_min_max": {"fields": [{"Source.IP4.min": 1}, {"Source.IP4.max": 1}], "background": 1},
	"target_ip4_min_max": {"fields": [{"Target.IP4.min": 1}, {"Target.IP4.max": 1}], "background": 1},
	"resolved_abuses": {"fields": [{"_CESNET.ResolvedAbuses": 1}], "background": 1}
}

Ukazky hodnot:

"{gte}": "2016-03-21T00:00:00"
"{lte}": "2016-03-23T00:00:00"
"{ip_s}": "27.254.67.139"
"{ip_t}": "158.196.0.0"
"{net_min_s}": "27.254.67.0"
"{net_max_s}": "27.254.67.255"
"{category1}": "Attempt.Login"
"{node.sw1}": "value": "Mentat"
"{node.name1}": "value": "cz.cesnet.mentat.warden_filer"

Dotazy:

{"$and": [
    {
	"$and": [
	    {
		"DetectTime": {
		    "$gte": "{gte}"
		}
	    },
	    {
		"DetectTime": {
		    "$lte": "{lte}"
		}
	    }
	]
    },
    {
	"$or": [
	    {
		"Source.IP4.ip": "{ip}"
	    },
	    {
		"Target.IP4.ip": "{ip}"
	    }
	]
    }
]}

----------

{ "$and": [
    {
	"$and": [
	    {
		"DetectTime": {
		    "$gte": "{gte}"
		}
	    },
	    {
		"DetectTime": {
		    "$lte": "{lte}"
		}
	    }
	]
    },
    {
	"$or": [
	   {
		"$and": [
		    {
			"Source.IP4.min": {
			    "$gte": "{net_min1}"
			}
		    },
		    {
			"Source.IP4.max": {
			    "$lte": "{net_max1}"
			}
		    }
		]
	   },
	   {
		"$and": [
		    {
			"Target.IP4.min": {
			    "$gte": "{net_min2}"
			}
		    },
		    {
			"Target.IP4.max": {
			    "$lte": "{net_max2}"
			}
		    }
		]
	   }
	]
    }
]}

----------

{ "$and": [
    {
	"$and": [
	    {
		"DetectTime": {
		    "$gte": "{gte}"
		}
	    },
	    {
		"DetectTime": {
		    "$lte": "{lte}"
		}
	    }
	]
    },
    {
	"$or": [
	    {
		"Source.IP4.ip": "{ip1}"
	    },
	    {
		"Target.IP4.ip": "{ip1}"
	    },
	    {
		"Source.IP4.ip": "{ip2}"
	    },
	    {
		"Target.IP4.ip": "{ip2}"
	    }
	]
    }
]}

------------

{"$and": [
    {
	"Source.IP4.ip": "{ip_s}"
    },
    {
	"Target.IP4.ip": "{ip_t}"
    },
    {
	"DetectTime": {
	    "$gte": "{gte}"
	}
    },
    {
	"DetectTime": {
	    "$lte": "{lte}"
	}
    },
    {
	"Category": "{category1}"
    },
    {
	"Node.SW": "{node.sw1}"
    },
    {
	"Node.Name": "{node.name1}"
    }
]}