Class: Lstash::Query

Inherits:
Object
  • Object
show all
Defined in:
lib/lstash/query.rb

Defined Under Namespace

Classes: FormatError, QueryMissing

Constant Summary collapse

LOGSTASH_PREFIX = 
'logstash-'.freeze
WILDCARD_QUERY = 
'*'.freeze
HOUR_IN_SECONDS = 
3600.freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(query_string = nil, arguments = {}) ⇒ Query

Returns a new instance of Query.



18
19
20
21
22
23
24
25
26
 
# File 'lib/lstash/query.rb', line 18

def initialize(query_string = nil, arguments = {})
  @query_string = query_string

  @anchor = time_parse(arguments[:anchor], 'today')
  @from   = time_parse(arguments[:from],   'today')
  @to     = time_parse(arguments[:to],     'now')

  @to = Time.now if @to > Time.now # prevent accessing non-existing times / indices
end

Instance Attribute Details

#from ⇒ Object

Returns the value of attribute from.



16
17
18
 
# File 'lib/lstash/query.rb', line 16

def from
  @from
end

#to ⇒ Object

Returns the value of attribute to.



16
17
18
 
# File 'lib/lstash/query.rb', line 16

def to
  @to
end

Instance Method Details

#each_hour(&block) ⇒ Object 



51
52
53
54
55
56
57
58
59
60
 
# File 'lib/lstash/query.rb', line 51

def each_hour(&block)
  # iterate over the whole range in blocks of one hour
  time_iterate(@from.utc, @to.utc - 1, HOUR_IN_SECONDS) do |hour|
    yield index_name(hour.to_date),
          Query.new(@query_string,
                    anchor: @anchor,
                    from:   hour,
                    to:     hour + HOUR_IN_SECONDS)
  end
end

#filter ⇒ Object 



42
43
44
45
46
47
48
49
 
# File 'lib/lstash/query.rb', line 42

def filter
  {
    filtered: {
      query:  es_query,
      filter: es_filter
    }
  }
end

#index_name(date) ⇒ Object 



28
29
30
 
# File 'lib/lstash/query.rb', line 28

def index_name(date)
  "#{LOGSTASH_PREFIX}#{date.strftime('%Y.%m.%d')}"
end

#search(from, size) ⇒ Object 



32
33
34
35
36
37
38
39
40
 
# File 'lib/lstash/query.rb', line 32

def search(from, size)
  {
    sort:   sort_order,
    fields: %w(message),
    query:  filter,
    from:   from,
    size:   size
  }
end