作者：來自 Elastic?Gustavo Llermaly

將我們的 Jira 內容索引到 Elaasticsearch 中以創建統一的數據源并使用文檔級別安全性進行搜索。

在本文中，我們將回顧 Elastic Jira 原生連接器的一個用例。我們將使用一個模擬項目，其中一家銀行正在開發一款匯款應用，需要將 Jira 中的信息集成到 Elastic 中。

原生連接器允許我們從票據、任務和其他文檔中獲取 Elastic 集群信息，集中數據并啟用高級搜索功能。

使用此連接器的主要好處是：

1. Jira 中的數據與 Elasticsearch 同步。
2. 訪問高級搜索功能。
3. 文檔級安全性 (DLS) 匹配源安全性。你只能搜索 Jira 中允許你查看的內容。

步驟

1. 配置 Jira 連接器
2. 將文檔索引到 Elasticsearch
3. 查詢數據
4. 文檔級安全性 (document level security? - DLS)

配置 Jira 連接器

首先，你需要從 Jira 獲取 API token 以連接到 Elasticsearch。轉到此鏈接了解如何創建它。

將其命名為 “elastic-connector”。它應該如下所示：

獲取 token 并進入 Kibana 儀表板。然后，轉到原生連接器并選擇 New Jira Cloud connector。

https://<YOUR_KIBANA_URL>/app/enterprise_search/content/connectors/new_connector?service_type=jira&connector_type=native

用 Kibana 端點替換 YOUR_KIBANA_URL。

將連接器命名為 “bank”，然后點擊 “Create and attach an index named bank”，即可創建一個同名的新索引。

完成了！現在我們需要配置我們的 Jira 數據。

由于我們不會使用自己的 SSL 證書，因此我們將保持 “Enable SSL” 關閉。

你可以在官方文檔中查看每個字段的詳細信息。

激活文檔級安全性 (DLS)，以便你獲得有權查看文檔的用戶和組。

正確配置連接器后，你可以繼續同步數據，如下所示。從 Jira 獲取數據可能需要幾分鐘。

• 完整內容（Full Content）：索引所有 Jira 文檔。
• 增量內容（Incremental Content）：僅索引自上次完整內容同步以來的更改。
• 訪問控制（Access Control）：在安全索引中索引 Jira 用戶以激活 DLS。

我們可以檢查連接器的概述來查看同步是否成功。

在 “Documents” 選項卡中，我們可以準確地看到使用連接器獲取的數據。第一次同步的對象是：

• Projects
• Issues
• Attachments

將文檔索引到 Elasticsearch

我們不僅限于跨連接器文檔進行搜索。Elasticsearch 允許你使用單個查詢搜索多個索引。

在我們的示例中，我們將其他文檔索引到 galactic_documents 索引中，以了解搜索如何與多個數據源配合使用：

• GBFF 合規手冊
• Galactic Banking App 用戶指南
• 技術規格報告

但在索引之前，我們將為每個字段創建優化映射：

PUT /galactic_documents
{"mappings": {"properties": {"document_id": {"type": "keyword"},"title": {"type": "text","fields": {"raw": {"type": "keyword"}}},"content": {"type": "text"},"release_date": {"type": "date","format": "yyyy-MM-dd"},"page_count": {"type": "integer"},"tags": {"type": "keyword"}}}
}

配置映射后，我們現在可以索引：

POST galactic_documents/_bulk
{ "index": { "_index": "galactic_documents", "_id": "1" } }
{ "document_id": "GBFF-001", "title": "Compliance Manual of the GBFF", "content": "This document sets forth the compliance standards for intergalactic financial entities: Quantum-level data encryption to guarantee security in all transactions. Mandatory multi-factor authentication for all users and administrators. Quarterly reviews of security policies and access audit logs.", "release_date": "2024-01-01", "page_count": 5, "tags": ["compliance", "security"] }
{ "index": { "_index": "galactic_documents", "_id": "2" } }
{ "document_id": "GBFF-002", "title": "User Guide for the Galactic Banking App", "content": "Welcome to the Galactic Banking application by Interstellar Finance Corp. Here you can: Transfer galactic credits to any registered account across the Milky Way. Check your balance and manage your investments in real-time. Access interplanetary loans with ease. For your security, use multi-factor authentication each time you log in.", "release_date": "2024-01-01", "page_count": 3, "tags": ["user guide", "application"] }
{ "index": { "_index": "galactic_documents", "_id": "3" } }
{ "document_id": "GBFF-003", "title": "Technical Specifications Report - Galactic Banking Project", "content": "This report details the technical architecture of the Galactic Banking application: Microservices-based backend for scalability and performance. Secure communication protocols utilizing quantum encryption. Transaction management adapted to environments with gravity variations and time dilation.", "release_date": "2024-01-01", "page_count": 7, "tags": ["technical", "specifications", "architecture"] }

查詢數據

現在我們有了 Jira 對象和文檔，我們可以一起搜索它們。

GET bank,galactic_documents/_search
{"query": {"multi_match": {"query": "galactic moon","fields": ["content","title","*description","*summary"]}}
}

查詢 “galactic moon” 將為我們獲取 Jira 對象和我們索引的文檔：

{"took": 3,"timed_out": false,"_shards": {"total": 3,"successful": 3,"skipped": 0,"failed": 0},"hits": {"total": {"value": 3,"relation": "eq"},"max_score": 1.2613049,"hits": [{"_index": "bank","_id": "Marketing Mars-MM-2","_score": 1.2613049,"_source": {"Type": "Task","Custom_Fields": {"Satisfaction": null,"Approvals": null,"Change reason": null,"Epic Link": null,"Actual end": null,"Design": null,"Campaign assets": null,"Department": null,"Story point estimate": null,"Approver groups": null,"[CHART] Date of First Response": null,"Request Type": null,"Campaign goals": null,"Project overview key": null,"Related projects": null,"Campaign type": null,"Impact": null,"Request participants": [],"Locked forms": null,"Time to first response": null,"Work category": null,"Audience": null,"Open forms": null,"Details": null,"Sprint": null,"Stakeholders": null,"Marketing asset type": null,"Submitted forms": null,"Start date": null,"Actual start": null,"Category": null,"Change risk": null,"Target start": null,"Issue color": null,"Parent Link": {"hasEpicLinkFieldDependency": false,"showField": false,"nonEditableReason": {"reason": "EPIC_LINK_SHOULD_BE_USED","message": "To set an epic as the parent, use the epic link instead"}},"Format": null,"Target end": null,"Approvers": null,"Team": null,"Change type": null,"Satisfaction date": null,"Request language": null,"Amount": null,"Rank": "0|i0003j:","Affected services": null,"Type": null,"Time to resolution": null,"Total forms": null,"[CHART] Time in Status": null,"Organizations": [],"Flagged": null,"Project overview status": null},"Issue": {"statuscategorychangedate": "2024-11-01T17:52:30.550-0300","issuetype": {"avatarId": 10318,"hierarchyLevel": 0,"name": "Task","self": "https://xxxx.atlassian.net/rest/api/2/issuetype/10017","description": "A small, distinct piece of work.","entityId": "f30ea676-7b3d-44ad-9858-558081742a2e","id": "10017","iconUrl": "https://xxxx.atlassian.net/rest/api/2/universal_avatar/view/type/issuetype/avatar/10318?size=medium","subtask": false},"components": [],"timespent": null,"timeoriginalestimate": null,"project": {"simplified": true,"avatarUrls": {"48x48": "https://xxxx.atlassian.net/rest/api/2/universal_avatar/view/type/project/avatar/10418","24x24": "https://xxxx.atlassian.net/rest/api/2/universal_avatar/view/type/project/avatar/10418?size=small","16x16": "https://xxxx.atlassian.net/rest/api/2/universal_avatar/view/type/project/avatar/10418?size=xsmall","32x32": "https://xxxx.atlassian.net/rest/api/2/universal_avatar/view/type/project/avatar/10418?size=medium"},"name": "Marketing Mars","self": "https://xxxx.atlassian.net/rest/api/2/project/10003","id": "10003","projectTypeKey": "business","key": "MM"},"description": null,"fixVersions": [],"aggregatetimespent": null,"resolution": null,"timetracking": {},"security": null,"aggregatetimeestimate": null,"attachment": [],"resolutiondate": null,"workratio": -1,"summary": "Conquer the moon","issuerestriction": {"issuerestrictions": {},"shouldDisplay": true},"watches": {"self": "https://xxxx.atlassian.net/rest/api/2/issue/MM-2/watchers","isWatching": true,"watchCount": 1},"lastViewed": "2024-11-01T17:52:34.925-0300","creator": {"accountId": "712020:88983800-6c97-469a-9451-79c2dd3732b5","emailAddress": "contornan_cliche.0y@icloud.com","avatarUrls": {"48x48": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","24x24": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","16x16": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","32x32": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png"},"displayName": "Tomas Murua","accountType": "atlassian","self": "https://xxxx.atlassian.net/rest/api/2/user?accountId=712020%3A88983800-6c97-469a-9451-79c2dd3732b5","active": true,"timeZone": "Chile/Continental"},"subtasks": [],"created": "2024-11-01T17:52:30.289-0300","reporter": {"accountId": "712020:88983800-6c97-469a-9451-79c2dd3732b5","emailAddress": "contornan_cliche.0y@icloud.com","avatarUrls": {"48x48": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","24x24": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","16x16": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png","32x32": "https://secure.gravatar.com/avatar/f098101294d1a0da282bb2388df8c257?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FTM-3.png"},"displayName": "Tomas Murua","accountType": "atlassian","self": "https://xxxx.atlassian.net/rest/api/2/user?accountId=712020%3A88983800-6c97-469a-9451-79c2dd3732b5","active": true,"timeZone": "Chile/Continental"},"aggregateprogress": {"total": 0,"progress": 0},"priority": {"name": "Medium","self": "https://xxxx.atlassian.net/rest/api/2/priority/3","iconUrl": "https://xxxx.atlassian.net/images/icons/priorities/medium.svg","id": "3"},"labels": [],"environment": null,"timeestimate": null,"aggregatetimeoriginalestimate": null,"versions": [],"duedate": null,"progress": {"total": 0,"progress": 0},"issuelinks": [],"votes": {"hasVoted": false,"self": "https://xxxx.atlassian.net/rest/api/2/issue/MM-2/votes","votes": 0},"comment": {"total": 0,"comments": [],"maxResults": 0,"self": "https://xxxx.atlassian.net/rest/api/2/issue/10018/comment","startAt": 0},"assignee": null,"worklog": {"total": 0,"maxResults": 20,"startAt": 0,"worklogs": []},"updated": "2024-11-01T17:52:42.711-0300","status": {"name": "To Do","self": "https://xxxx.atlassian.net/rest/api/2/status/10014","description": "","iconUrl": "https://xxxx.atlassian.net/","id": "10014","statusCategory": {"colorName": "blue-gray","name": "To Do","self": "https://xxxx.atlassian.net/rest/api/2/statuscategory/2","id": 2,"key": "new"}}},"id": "Marketing Mars-MM-2","_timestamp": "2024-11-01T17:52:42.711-0300","Key": "MM-2","_allow_access_control": ["account_id:712020:88983800-6c97-469a-9451-79c2dd3732b5","name:Tomas-Murua"]}},{"_index": "galactic_documents","_id": "2","_score": 0.61183906,"_source": {"document_id": "GBFF-002","title": "User Guide for the Galactic Banking App","content": "Welcome to the Galactic Banking application by Interstellar Finance Corp. Here you can: Transfer galactic credits to any registered account across the Milky Way. Check your balance and manage your investments in real-time. Access interplanetary loans with ease. For your security, use multi-factor authentication each time you log in.","release_date": "2024-01-01","page_count": 3,"tags": ["user guide","application"]}},{"_index": "galactic_documents","_id": "3","_score": 0.5029222,"_source": {"document_id": "GBFF-003","title": "Technical Specifications Report - Galactic Banking Project","content": "This report details the technical architecture of the Galactic Banking application: Microservices-based backend for scalability and performance. Secure communication protocols utilizing quantum encryption. Transaction management adapted to environments with gravity variations and time dilation.","release_date": "2024-01-01","page_count": 7,"tags": ["technical","specifications","architecture"]}}]}
}

如果文檔太長，你可以將選項 _source 添加到查詢中，以僅包含你需要的字段。如果你只想刪除一些字段，我們將在本系列的第二部分介紹該選項。

文檔級安全性 (DLS)

我們現在將配置文檔級安全性 (DLS)，以將 Jira 權限與 Elasticsearch 中的權限相匹配，以便用戶搜索時只能看到他們在 Jira 中被允許看到的內容。

首先，我們將轉到 Elastic Cloud 中連接器的控制面板，然后單擊 Access Control Sync。

此同步將帶來 Jira 用戶的訪問和權限信息。為了測試這一點，我創建了另一個 Jira 板（board），但用戶 “Gustavo” 無權訪問該板。

注意：創建板后，不要忘記運行內容同步。你可以運行一次性同步，也可以按計劃運行。

讓我們開始檢查新板中的文檔是否存在：

GET bank/_search
{"_source": ["Issue.summary"],"query": {"match": {"Issue.project.name": "Marketing Mars"}}
}

我們可以有效地看到以下問題：

{"took": 2,"timed_out": false,"_shards": {"total": 2,"successful": 2,"skipped": 0,"failed": 0},"hits": {"total": {"value": 3,"relation": "eq"},"max_score": 0.7473189,"hits": [{"_index": "bank","_id": "Marketing Mars-MM-1","_score": 0.7473189,"_source": {"Issue": {"summary": "Conquer Mars"}}},{"_index": "bank","_id": "Marketing Mars-MM-3","_score": 0.7473189,"_source": {"Issue": {"summary": "Conquering Earth"}}},{"_index": "bank","_id": "Marketing Mars-MM-2","_score": 0.7473189,"_source": {"Issue": {"summary": "Conquer the moon"}}}]}
}

但是，由于用戶 “Gustavo” 沒有訪問權限，因此他應該無法看到它們。

讓我們在 ACL 過濾器索引中查找用戶的文檔以查看他們的權限。

GET .search-acl-filter-bank/_search

響應：

{"_index": ".search-acl-filter-bank","_id": "63c04b092341bff4fff6e0cb","_score": 1,"_source": {"created_at": "2024-11-01T23:19:35.784996+00:00","id": "63c04b092341bff4fff6e0cb","_timestamp": "2024-11-01T05:42:04.410478+00:00","identity": {"account_id": "account_id:63c04b092341bff4fff6e0cb","email_address": null,"display_name": "name:Gustavo","locale": "locale:en_US"},"query": {"template": {"source": """{"bool": {"should": [{"bool": {"must_not": {"exists": {"field": "_allow_access_control"}}}},{"terms": {"_allow_access_control.enum": {{#toJson}}access_control{{/toJson}}}}]}}""","params": {"access_control": ["account_id:63c04b092341bff4fff6e0cb","group_id:d3f28403-7e99-4262-8f11-77a75bcd33d8","role_key:jira-software"]}}}}
}

該索引包括用戶 ID 及其所有 Jira 組。我們需要將用戶訪問控制中的內容與每個文檔中的字段 _allowed_access_control 進行匹配。

我們將使用以下命令為 Gustavo 創建 API 密鑰。你必須從上一步復制 query.template 值：

POST /_security/api_key
{"name": "gustavo","expiration": "30d","role_descriptors": {"jira-role": {"index": [{"names": ["bank","galactic_documents"],"privileges": ["read","view_index_metadata"],"query": {"template": {"params": {"access_control": ["account_id:63c04b092341bff4fff6e0cb","group_id:d3f28403-7e99-4262-8f11-77a75bcd33d8","role_key:jira-software"]},"source": """{"bool": {"should": [{"bool": {"must_not": {"exists": {"field": "_allow_access_control"}}}},{"terms": {"_allow_access_control.enum": {{#toJson}}access_control{{/toJson}}}}]}}"""}}}]}}
}

請注意，我們僅通過此選項授予對本文中索引的訪問權限。

為 Gustavo 創建 API 密鑰的響應如下：

{"id": "yLa1FJMBU4bZPaw5Stnl","name": "gustavo","expiration": 1733811245816,"api_key": "UrGdsnDFSyGxjQvLayw5jQ","encoded": "eUxhMUZKTUJVNGJaUGF3NVN0bmw6VXJHZHNuREZTeUd4alF2TGF5dzVqUQ=="
}

你可以使用 curl 來測試我們是否可以使用 API KEY 運行搜索，并且它不會從 Marketing board 獲取信息，因為 Gustavo 無權訪問它。

curl --location --request GET 'https://interstellar-finance-corp.es.us-central1.gcp.cloud.es.io/bank/_search' \
--header 'Authorization: ApiKey eUxhMUZKTUJVNGJaUGF3NVN0bmw6VXJHZHNuREZTeUd4alF2TGF5dzVqUQ==' \
--header 'Content-Type: application/json' \
--data '{"_source": ["Issue.summary"],"query": {"match": {"Issue.project.name": "Marketing Mars"}}
}'

響應：

{"took": 0,"timed_out": false,"_shards": {"total": 1,"successful": 1,"skipped": 0,"failed": 0},"hits": {"total": {"value": 0,"relation": "eq"},"max_score": null,"hits": []}
}

我們可以看到，Gustavo 沒有獲得任何信息，因為他沒有訪問權限。現在，讓我們用他被允許查看的 board 文件進行測試：

curl --location --request GET 'https://interstellar-finance-corp.es.us-central1.gcp.cloud.es.io/bank/_search?pretty=true' \
--header 'Authorization: ApiKey eUxhMUZKTUJVNGJaUGF3NVN0bmw6VXJHZHNuREZTeUd4alF2TGF5dzVqUQ==' \
--header 'Content-Type: application/json' \
--data '{"_source": ["Issue.summary"],"query": {"match": {"Issue.project.name": "Galactic Banking Project"}}
}'

響應：

{"took" : 7,"timed_out" : false,"_shards" : {"total" : 2,"successful" : 2,"skipped" : 0,"failed" : 0},"hits" : {"total" : {"value" : 3,"relation" : "eq"},"max_score" : 3.1784885,"hits" : [{"_index" : "bank","_id" : "Galactic Banking Project-GBP-3","_score" : 3.1784885,"_source" : {"Issue" : {"summary" : "Intergalactic Security and Compliance"}}},{"_index" : "bank","_id" : "Galactic Banking Project-GBP-2","_score" : 0.5469647,"_source" : {"Issue" : {"summary" : "Bank Application Frontend"}}},{"_index" : "bank","_id" : "Galactic Banking Project-GBP-1","_score" : 0.5469647,"_source" : {"Issue" : {"summary" : "Development of API for International Transfers"}}}]}
}

結論

如你所見，將 Elasticsearch 與 Jira 集成有許多好處，例如能夠對你正在處理的所有項目進行統一搜索，以及能夠在多個數據源中運行更高級的搜索。添加的 DLS 是一種快速簡便的方法，可確保用戶保持他們在原始源中已有的訪問權限。

想要獲得 Elastic 認證？了解下一次 Elasticsearch 工程師培訓何時開始！

Elasticsearch 包含新功能，可幫助你為你的用例構建最佳搜索解決方案。深入了解我們的示例筆記本以了解更多信息，開始免費云試用，或立即在你的本地機器上試用 Elastic。

原文：Jira connector tutorial part I - Elasticsearch Labs