Query array of arrays in MongoDB [closed]

You could possibly do this using $and, albeit in quite a messy way:

db.rules.find({ "$and": [
    {"opts":{"$elemMatch":{"$all":["sid","1226"]}}},
    {"opts":{"$elemMatch":{"$all":["gid","1"]}}},
    {"opts":{"$elemMatch":{"$all":["rev","10"]}}},
]})

That is untested, but may work. The real problem here is the nested arrays, and that each "option" set is in it's own array.

To do this better, the n you need to change the output from the Parse::Snort module to writing the options as one straight hash, but putting that into an array. Inserted using the MongoDB driver, the result should look like this:

{
    "_id" : ObjectId("5328b974be4ed1400900000a"),
    "dst_port" : "6000",
    "opts" : [{ 
        "msg": "\"X11 xopen\"", 
        "flow": "established", 
        "content": "\"l|00 0B 00 00 00 00 00 00 00 00 00|\"", 
        "fast_pattern": "only", 
        "metadata": "ruleset community", 
        "classtype": "unknown", 
        "sid": "1226", 
        "rev": "10", 
        "gid": "1"
    }],
    "proto" : "tcp",
    "direction" : "->",
    "src" : "$EXTERNAL_NET",
    "update" : "0",
    "action" : "alert",
    "dst" : "$HOME_NET",
    "src_port" : "any"
}

So the producing code is the problem ans should have probably looked something like this:

use Parse::Snort;
use MongoDB;
use Tie::IxHash;

my $client = MongoDB::MongoClient->new( host => 'yourhost' );
my $db = $client->get_database("yourdb");
my $collection = $db->get_collection("yourCollection");

# Then looping for each snort rule

my $rule = Parse::Snort->new();
$rule->parse("snortRule");

my $ruleObj = {};
tie %{$ruleObj}, 'Tie::IxHash';

foreach my $key (qw/ proto direction src update action dst src_port /) {
    $ruleObj->{$key} = $rule->$key if (defined $rule->$key);
}

if ( length(@{$rule->opts}) != 0 ) [

    my $opts = {};
    tie %{$opts}, 'Tie::IxHash';

    foreach my $opt ( $rule->opts ) {
        $opts->{ $opt[0] } = $opt[1];            
    }

    $ruleObj->{opts} = [$opts];
}

$collection->insert( $ruleObj );

And that will store the records correctly as shown above.

Then you can query for your matching document like this:

db.collection.find(
    { "opts": {"$elemMatch": { "sid": "1226", "gid": "0", "rev": "10" } } }
)

Which is a nicer way to look at it.