From 58d7bbad41c90901dfd84c2854e3c4e19e5c5dab Mon Sep 17 00:00:00 2001
From: shouzhiyuxian <2512941932@qq.com>
Date: Fri, 31 Jul 2026 11:20:08 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DV3=E5=AF=B9=E6=8E=A5es?=
 =?UTF-8?q?=E5=90=8E=EF=BC=8C=E9=80=9A=E8=BF=87=E8=B5=84=E4=BA=A7=E6=90=9C?=
 =?UTF-8?q?=E7=B4=A2=E5=91=BD=E4=BB=A4=E5=B1=95=E7=A4=BA=E7=BB=93=E6=9E=9C?=
 =?UTF-8?q?=E6=B7=B7=E4=B9=B1=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/common/plugins/es.py            | 18 ++++++++++++++++--
 apps/terminal/backends/command/es.py |  5 +++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/apps/common/plugins/es.py b/apps/common/plugins/es.py
index c4b2d0921..2966964eb 100644
--- a/apps/common/plugins/es.py
+++ b/apps/common/plugins/es.py
@@ -114,7 +114,7 @@ def get_es_client_version(**kwargs):
 
 class ES(object):
 
-    def __init__(self, config, properties, keyword_fields, exact_fields=None, match_fields=None):
+    def __init__(self, config, properties, keyword_fields, exact_fields=None, fuzzy_fields=None, match_fields=None):
         self.version = 7
         self.config = config
         hosts = self.config.get('HOSTS')
@@ -131,12 +131,14 @@ class ES(object):
         self.index = None
         self.query_index = None
         self.properties = properties
-        self.exact_fields, self.match_fields, self.keyword_fields = set(), set(), set()
+        self.exact_fields, self.match_fields, self.keyword_fields, self.fuzzy_fields = set(), set(), set(), set()
 
         if isinstance(keyword_fields, Iterable):
             self.keyword_fields.update(keyword_fields)
         if isinstance(exact_fields, Iterable):
             self.exact_fields.update(exact_fields)
+        if isinstance(fuzzy_fields, Iterable):
+            self.fuzzy_fields.update(fuzzy_fields)
         if isinstance(match_fields, Iterable):
             self.match_fields.update(match_fields)
 
@@ -306,6 +308,13 @@ class ES(object):
             })
         return _filter
 
+    @staticmethod
+    def handle_fuzzy_fields(exact):
+        _filter = []
+        for k, v in exact.items():
+            _filter.append({'wildcard': {k: f'*{v}*'}})
+        return _filter
+
     def get_query_body(self, **kwargs):
         new_kwargs = {}
         for k, v in kwargs.items():
@@ -321,9 +330,11 @@ class ES(object):
         index_in_field = 'id__in'
         exact_fields = self.exact_fields
         match_fields = self.match_fields
+        fuzzy_fields = self.fuzzy_fields
 
         match = {}
         exact = {}
+        fuzzy = {}
         index = {}
 
         if index_in_field in kwargs:
@@ -332,6 +343,8 @@ class ES(object):
         for k, v in kwargs.items():
             if k in exact_fields:
                 exact[k] = v
+            elif k in fuzzy_fields:
+                fuzzy[f"{k}.keyword"] = v
             elif k in match_fields:
                 match[k] = v
 
@@ -368,6 +381,7 @@ class ES(object):
                     ],
                     'should': should,
                     'filter': self.handle_exact_fields(exact) +
+                              self.handle_fuzzy_fields(fuzzy) +
                               [
                                   {
                                       'range': {
diff --git a/apps/terminal/backends/command/es.py b/apps/terminal/backends/command/es.py
index f87d169ff..bec75e3bf 100644
--- a/apps/terminal/backends/command/es.py
+++ b/apps/terminal/backends/command/es.py
@@ -28,10 +28,11 @@ class CommandStore(ES):
             }
         }
         exact_fields = {}
-        match_fields = {'input', 'risk_level', 'user', 'asset', 'system_user'}
+        fuzzy_fields = {'input', 'user', 'asset', 'system_user'}
+        match_fields = {'input', 'risk_level'}
         keyword_fields = {'session', 'org_id'}
 
-        super().__init__(config, properties, keyword_fields, exact_fields, match_fields)
+        super().__init__(config, properties, keyword_fields, exact_fields, fuzzy_fields, match_fields)
 
     @staticmethod
     def make_data(command):