Examples with SearchResponse org.apache.metron.indexing.dao.search.SearchResponse used on opensource projects

Example 26 with SearchResponse

use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.

the class SearchIntegrationTest method all_query_returns_all_results.

@Test
public void all_query_returns_all_results() throws Exception {
    SearchRequest request = JSONUtils.INSTANCE.load(allQuery, SearchRequest.class);
    SearchResponse response = dao.search(request);
    Assert.assertEquals(10, response.getTotal());
    List<SearchResult> results = response.getResults();
    Assert.assertEquals(10, results.size());
    for (int i = 0; i < 5; ++i) {
        Assert.assertEquals("snort", results.get(i).getSource().get("source:type"));
        Assert.assertEquals(10 - i, results.get(i).getSource().get("timestamp"));
    }
    for (int i = 5; i < 10; ++i) {
        Assert.assertEquals("bro", results.get(i).getSource().get("source:type"));
        Assert.assertEquals(10 - i, results.get(i).getSource().get("timestamp"));
    }
}

Example 27 with SearchResponse

use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.

the class SearchIntegrationTest method results_are_paginated.

@Test
public void results_are_paginated() throws Exception {
    SearchRequest request = JSONUtils.INSTANCE.load(paginationQuery, SearchRequest.class);
    SearchResponse response = dao.search(request);
    Assert.assertEquals(10, response.getTotal());
    List<SearchResult> results = response.getResults();
    Assert.assertEquals(3, results.size());
    Assert.assertEquals("snort", results.get(0).getSource().get("source:type"));
    Assert.assertEquals(6, results.get(0).getSource().get("timestamp"));
    Assert.assertEquals("bro", results.get(1).getSource().get("source:type"));
    Assert.assertEquals(5, results.get(1).getSource().get("timestamp"));
    Assert.assertEquals("bro", results.get(2).getSource().get("source:type"));
    Assert.assertEquals(4, results.get(2).getSource().get("timestamp"));
}

Example 28 with SearchResponse

use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.

the class ElasticsearchSearchDao method buildSearchResponse.

/**
 * Builds a search response.
 *
 * This effectively transforms an Elasticsearch search response into a Metron search response.
 *
 * @param searchRequest The Metron search request.
 * @param esResponse The Elasticsearch search response.
 * @return A Metron search response.
 * @throws InvalidSearchException
 */
private SearchResponse buildSearchResponse(SearchRequest searchRequest, org.elasticsearch.action.search.SearchResponse esResponse) throws InvalidSearchException {
    SearchResponse searchResponse = new SearchResponse();
    searchResponse.setTotal(esResponse.getHits().getTotalHits());
    // search hits --> search results
    List<SearchResult> results = new ArrayList<>();
    for (SearchHit hit : esResponse.getHits().getHits()) {
        results.add(getSearchResult(hit, searchRequest.getFields()));
    }
    searchResponse.setResults(results);
    // handle facet fields
    if (searchRequest.getFacetFields() != null) {
        List<String> facetFields = searchRequest.getFacetFields();
        Map<String, FieldType> commonColumnMetadata;
        try {
            commonColumnMetadata = columnMetadataDao.getColumnMetadata(searchRequest.getIndices());
        } catch (IOException e) {
            throw new InvalidSearchException(String.format("Could not get common column metadata for indices %s", Arrays.toString(searchRequest.getIndices().toArray())));
        }
        searchResponse.setFacetCounts(getFacetCounts(facetFields, esResponse.getAggregations(), commonColumnMetadata));
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("Built search response; response={}", ElasticsearchUtils.toJSON(searchResponse).orElse("???"));
    }
    return searchResponse;
}

Example 29 with SearchResponse

use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.

the class ElasticsearchMetaAlertUpdateDao method update.

@Override
public Document update(Document update, Optional<String> index) throws IOException {
    if (MetaAlertConstants.METAALERT_TYPE.equals(update.getSensorType())) {
        // We've been passed an update to the meta alert.
        throw new UnsupportedOperationException("Meta alerts cannot be directly updated");
    } else {
        Map<Document, Optional<String>> updates = new HashMap<>();
        updates.put(update, index);
        try {
            // We need to update an alert itself.  Only that portion of the update can be delegated.
            // We still need to get meta alerts potentially associated with it and update.
            SearchResponse response = getMetaAlertsForAlert(update.getGuid());
            Collection<Document> metaAlerts = response.getResults().stream().map(result -> toDocument(result, update.getTimestamp())).collect(Collectors.toList());
            // Each meta alert needs to be updated with the new alert
            for (Document metaAlert : metaAlerts) {
                replaceAlertInMetaAlert(metaAlert, update);
                updates.put(metaAlert, Optional.of(METAALERTS_INDEX));
            }
        } catch (IndexNotFoundException e) {
            List<String> indicesNotFound = e.getMetadata(INDEX_NOT_FOUND_INDICES_KEY);
            // Otherwise throw the exception.
            if (indicesNotFound.size() != 1 || !METAALERTS_INDEX.equals(indicesNotFound.get(0))) {
                throw e;
            }
        }
        // Run the alert's update
        elasticsearchDao.batchUpdate(updates);
        return update;
    }
}

Example 30 with SearchResponse

use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.

the class MetaAlertIntegrationTest method shouldGetAllMetaAlertsForAlert.

@Test
public void shouldGetAllMetaAlertsForAlert() throws Exception {
    // Load alerts
    List<Map<String, Object>> alerts = buildAlerts(3);
    addRecords(alerts, getTestIndexFullName(), SENSOR_NAME);
    // Load metaAlerts
    List<Map<String, Object>> metaAlerts = buildMetaAlerts(12, MetaAlertStatus.ACTIVE, Optional.of(Collections.singletonList(alerts.get(0))));
    metaAlerts.add(buildMetaAlert("meta_active_12", MetaAlertStatus.ACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    metaAlerts.add(buildMetaAlert("meta_inactive", MetaAlertStatus.INACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    // We pass MetaAlertDao.METAALERT_TYPE, because the "_doc" gets appended automatically.
    addRecords(metaAlerts, getMetaAlertIndex(), METAALERT_TYPE);
    // Verify load was successful
    List<GetRequest> createdDocs = metaAlerts.stream().map(metaAlert -> new GetRequest((String) metaAlert.get(Constants.GUID), METAALERT_TYPE)).collect(Collectors.toList());
    createdDocs.addAll(alerts.stream().map(alert -> new GetRequest((String) alert.get(Constants.GUID), SENSOR_NAME)).collect(Collectors.toList()));
    findCreatedDocs(createdDocs);
    {
        // Verify searches successfully return more than 10 results
        SearchResponse searchResponse0 = metaDao.getAllMetaAlertsForAlert("message_0");
        List<SearchResult> searchResults0 = searchResponse0.getResults();
        assertEquals(13, searchResults0.size());
        Set<Map<String, Object>> resultSet = new HashSet<>();
        Iterables.addAll(resultSet, Iterables.transform(searchResults0, r -> r.getSource()));
        StringBuffer reason = new StringBuffer("Unable to find " + metaAlerts.get(0) + "\n");
        reason.append(Joiner.on("\n").join(resultSet));
        assertTrue(resultSet.contains(metaAlerts.get(0)), reason.toString());
        // Verify no meta alerts are returned because message_1 was not added to any
        SearchResponse searchResponse1 = metaDao.getAllMetaAlertsForAlert("message_1");
        List<SearchResult> searchResults1 = searchResponse1.getResults();
        assertEquals(0, searchResults1.size());
        // Verify only the meta alert message_2 was added to is returned
        SearchResponse searchResponse2 = metaDao.getAllMetaAlertsForAlert("message_2");
        List<SearchResult> searchResults2 = searchResponse2.getResults();
        assertEquals(1, searchResults2.size());
        assertEquals(metaAlerts.get(12), searchResults2.get(0).getSource());
    }
}