elasticsearch/esclean.py: use match for fleet field

Signed-off-by: Jakub Sokołowski <jakub@status.im>
2023-06-26 21:04:27 +02:00 · 2023-06-26 21:04:27 +02:00 · 1e1228cd3a
parent dba844b9d3
commit 1e1228cd3a
1 changed files with 1 additions and 1 deletions
--- a/elasticsearch/esclean.py
+++ b/elasticsearch/esclean.py
@ -71,7 +71,7 @@ def main():
    elif opts.program:
        queries.append({'term': {'program': opts.program}})
    if opts.fleet:
-        queries.append({'term': {'fleet': opts.fleet}})
+        queries.append({'match': {'fleet': opts.fleet}})
    if opts.severity:
        queries.append({'term': {'severity_name': opts.severity}})
    if opts.logsource_ip: