Search in sources :

Example 6 with QueryResult

use of org.graylog.plugins.views.search.QueryResult in project graylog2-server by Graylog2.

the class QueryEngine method prepareAndRun.

private QueryResult prepareAndRun(SearchJob searchJob, Query query) {
    final QueryBackend<? extends GeneratedQueryContext> backend = getQueryBackend(query);
    LOG.debug("[{}] Using {} to generate query", query.id(), backend);
    // with all the results done, we can execute the current query and eventually complete our own result
    // if any of this throws an exception, the handle in #execute will convert it to an error and return a "failed" result instead
    // if the backend already returns a "failed result" then nothing special happens here
    final GeneratedQueryContext generatedQueryContext = backend.generate(searchJob, query, searchConfig.get());
    LOG.trace("[{}] Generated query {}, running it on backend {}", query.id(), generatedQueryContext, backend);
    final QueryResult result = backend.run(searchJob, query, generatedQueryContext);
    LOG.debug("[{}] Query returned {}", query.id(), result);
    if (!generatedQueryContext.errors().isEmpty()) {
        generatedQueryContext.errors().forEach(searchJob::addError);
    }
    return result;
}
Also used : QueryResult(org.graylog.plugins.views.search.QueryResult)

Example 7 with QueryResult

use of org.graylog.plugins.views.search.QueryResult in project graylog2-server by Graylog2.

the class SearchResource method extractSearchResponse.

protected SearchResponse extractSearchResponse(SearchJob searchJob, String query, boolean decorate, List<String> fieldList, TimeRange timeRange, Optional<String> streamId) {
    final QueryResult queryResult = searchJob.results().values().stream().findFirst().orElseThrow(() -> new IllegalStateException("Missing query result"));
    final MessageList.Result result = queryResult.searchTypes().values().stream().findFirst().map(searchTypeResult -> (MessageList.Result) searchTypeResult).orElseThrow(() -> new IllegalStateException("Missing search type result!"));
    final long tookMs = queryResult.executionStats().duration();
    return buildSearchResponse(query, result, fieldList, tookMs, timeRange, decorate, streamId);
}
Also used : LoggerFactory(org.slf4j.LoggerFactory) SearchResponse(org.graylog2.rest.resources.search.responses.SearchResponse) Searches(org.graylog2.indexer.searches.Searches) NotEmpty(javax.validation.constraints.NotEmpty) ResultMessage(org.graylog2.indexer.results.ResultMessage) ClusterConfigService(org.graylog2.plugin.cluster.ClusterConfigService) Locale(java.util.Locale) DecoratorProcessor(org.graylog2.decorators.DecoratorProcessor) AbsoluteRange(org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange) BadRequestException(javax.ws.rs.BadRequestException) Splitter(com.google.common.base.Splitter) SearchResult(org.graylog2.indexer.results.SearchResult) TimeRange(org.graylog2.plugin.indexer.searches.timeranges.TimeRange) Sorting(org.graylog2.indexer.searches.Sorting) ImmutableSet(com.google.common.collect.ImmutableSet) Set(java.util.Set) Collectors(java.util.stream.Collectors) Sets(com.google.common.collect.Sets) List(java.util.List) ExecutionState(org.graylog.plugins.views.search.rest.ExecutionState) Optional(java.util.Optional) SearchUser(org.graylog.plugins.views.search.permissions.SearchUser) ChunkedOutput(org.glassfish.jersey.server.ChunkedOutput) Query(org.graylog.plugins.views.search.Query) IndexRangeSummary(org.graylog2.rest.models.system.indexer.responses.IndexRangeSummary) Strings.isNullOrEmpty(com.google.common.base.Strings.isNullOrEmpty) ScrollResult(org.graylog2.indexer.results.ScrollResult) ResultMessageSummary(org.graylog2.rest.models.messages.responses.ResultMessageSummary) ArrayList(java.util.ArrayList) ElasticsearchQueryString(org.graylog.plugins.views.search.elasticsearch.ElasticsearchQueryString) Strings(com.google.common.base.Strings) Lists(com.google.common.collect.Lists) SearchType(org.graylog.plugins.views.search.SearchType) SearchExecutor(org.graylog.plugins.views.search.rest.SearchExecutor) QueryStringFilter(org.graylog.plugins.views.search.filter.QueryStringFilter) Sort(org.graylog.plugins.views.search.searchtypes.Sort) Search(org.graylog.plugins.views.search.Search) MessageList(org.graylog.plugins.views.search.searchtypes.MessageList) QueryResult(org.graylog.plugins.views.search.QueryResult) Period(org.joda.time.Period) SearchJob(org.graylog.plugins.views.search.SearchJob) Logger(org.slf4j.Logger) ForbiddenException(javax.ws.rs.ForbiddenException) DateTime(org.joda.time.DateTime) RestResource(org.graylog2.shared.rest.resources.RestResource) IOException(java.io.IOException) IndexRange(org.graylog2.indexer.ranges.IndexRange) SearchesClusterConfig(org.graylog2.indexer.searches.SearchesClusterConfig) RestPermissions(org.graylog2.shared.security.RestPermissions) Message(org.graylog2.plugin.Message) Collections(java.util.Collections) QueryResult(org.graylog.plugins.views.search.QueryResult) MessageList(org.graylog.plugins.views.search.searchtypes.MessageList) SearchResult(org.graylog2.indexer.results.SearchResult) ScrollResult(org.graylog2.indexer.results.ScrollResult) QueryResult(org.graylog.plugins.views.search.QueryResult)

Example 8 with QueryResult

use of org.graylog.plugins.views.search.QueryResult in project graylog2-server by Graylog2.

the class QueryBackend method run.

// TODO we can probably push job and query into the GeneratedQueryContext to simplify the signature
default QueryResult run(SearchJob job, Query query, GeneratedQueryContext generatedQueryContext) {
    try {
        final Stopwatch stopwatch = Stopwatch.createStarted();
        final QueryExecutionStats.Builder statsBuilder = QueryExecutionStats.builderWithCurrentTime();
        // https://www.ibm.com/developerworks/java/library/j-jtp04298/index.html#3.0
        // noinspection unchecked
        final QueryResult result = doRun(job, query, (T) generatedQueryContext);
        stopwatch.stop();
        return result.toBuilder().executionStats(statsBuilder.duration(stopwatch.elapsed(TimeUnit.MILLISECONDS)).effectiveTimeRange(effectiveTimeRangeForResult(query, result)).build()).build();
    } catch (Exception e) {
        // the backend has very likely created a more specific error and added it to the context, but we fall
        // back to a generic error so we never throw exceptions into the engine.
        final QueryError queryError = new QueryError(query, e);
        generatedQueryContext.addError(queryError);
        return QueryResult.failedQueryWithError(query, queryError);
    }
}
Also used : QueryResult(org.graylog.plugins.views.search.QueryResult) Stopwatch(com.google.common.base.Stopwatch) QueryError(org.graylog.plugins.views.search.errors.QueryError) IllegalTimeRangeException(org.graylog.plugins.views.search.errors.IllegalTimeRangeException)

Example 9 with QueryResult

use of org.graylog.plugins.views.search.QueryResult in project graylog2-server by Graylog2.

the class QueryEngine method execute.

public SearchJob execute(SearchJob searchJob) {
    searchJob.getSearch().queries().forEach(query -> searchJob.addQueryResultFuture(query.id(), // if need be we default to an empty result with a failed state and the wrapped exception
    CompletableFuture.supplyAsync(() -> prepareAndRun(searchJob, query), queryPool).handle((queryResult, throwable) -> {
        if (throwable != null) {
            final Throwable cause = throwable.getCause();
            final SearchError error;
            if (cause instanceof SearchException) {
                error = ((SearchException) cause).error();
            } else {
                error = new QueryError(query, cause);
            }
            LOG.debug("Running query {} failed: {}", query.id(), cause);
            searchJob.addError(error);
            return QueryResult.failedQueryWithError(query, error);
        }
        return queryResult;
    })));
    searchJob.getSearch().queries().forEach(query -> {
        final CompletableFuture<QueryResult> queryResultFuture = searchJob.getQueryResultFuture(query.id());
        if (!queryResultFuture.isDone()) {
            // this is not going to throw an exception, because we will always replace it with a placeholder "FAILED" result above
            final QueryResult result = queryResultFuture.join();
        } else {
            LOG.debug("[{}] Not generating query for query {}", defaultIfEmpty(query.id(), "root"), query);
        }
    });
    LOG.debug("Search job {} executing", searchJob.getId());
    return searchJob.seal();
}
Also used : QueryResult(org.graylog.plugins.views.search.QueryResult) SearchError(org.graylog.plugins.views.search.errors.SearchError) SearchException(org.graylog.plugins.views.search.errors.SearchException) QueryError(org.graylog.plugins.views.search.errors.QueryError)

Example 10 with QueryResult

use of org.graylog.plugins.views.search.QueryResult in project graylog2-server by Graylog2.

the class ElasticsearchBackend method doRun.

@Override
public QueryResult doRun(SearchJob job, Query query, ESGeneratedQueryContext queryContext) {
    if (query.searchTypes().isEmpty()) {
        return QueryResult.builder().query(query).searchTypes(Collections.emptyMap()).errors(new HashSet<>(queryContext.errors())).build();
    }
    LOG.debug("Running query {} for job {}", query.id(), job.getId());
    final HashMap<String, SearchType.Result> resultsMap = Maps.newHashMap();
    final Set<String> affectedIndices = indexLookup.indexNamesForStreamsInTimeRange(query.usedStreamIds(), query.timerange());
    final Map<String, SearchSourceBuilder> searchTypeQueries = queryContext.searchTypeQueries();
    final List<String> searchTypeIds = new ArrayList<>(searchTypeQueries.keySet());
    final List<Search> searches = searchTypeIds.stream().map(searchTypeId -> {
        final Set<String> affectedIndicesForSearchType = query.searchTypes().stream().filter(s -> s.id().equalsIgnoreCase(searchTypeId)).findFirst().flatMap(searchType -> {
            if (searchType.effectiveStreams().isEmpty() && !query.globalOverride().flatMap(GlobalOverride::timerange).isPresent() && !searchType.timerange().isPresent()) {
                return Optional.empty();
            }
            final Set<String> usedStreamIds = searchType.effectiveStreams().isEmpty() ? query.usedStreamIds() : searchType.effectiveStreams();
            return Optional.of(indexLookup.indexNamesForStreamsInTimeRange(usedStreamIds, query.effectiveTimeRange(searchType)));
        }).orElse(affectedIndices);
        return new Search.Builder(searchTypeQueries.get(searchTypeId).toString()).addType(IndexMapping.TYPE_MESSAGE).addIndex(affectedIndicesForSearchType.isEmpty() ? Collections.singleton("") : affectedIndicesForSearchType).allowNoIndices(false).ignoreUnavailable(false).build();
    }).collect(Collectors.toList());
    final MultiSearch.Builder multiSearchBuilder = new MultiSearch.Builder(searches);
    final MultiSearchResult result = JestUtils.execute(jestClient, multiSearchBuilder.build(), () -> "Unable to perform search query: ");
    for (SearchType searchType : query.searchTypes()) {
        final String searchTypeId = searchType.id();
        final Provider<ESSearchTypeHandler<? extends SearchType>> handlerProvider = elasticsearchSearchTypeHandlers.get(searchType.type());
        if (handlerProvider == null) {
            LOG.error("Unknown search type '{}', cannot convert query result.", searchType.type());
            // no need to add another error here, as the query generation code will have added the error about the missing handler already
            continue;
        }
        if (isSearchTypeWithError(queryContext, searchTypeId)) {
            LOG.error("Failed search type '{}', cannot convert query result, skipping.", searchType.type());
            // no need to add another error here, as the query generation code will have added the error about the missing handler already
            continue;
        }
        // we create a new instance because some search type handlers might need to track information between generating the query and
        // processing its result, such as aggregations, which depend on the name and type
        final ESSearchTypeHandler<? extends SearchType> handler = handlerProvider.get();
        final int searchTypeIndex = searchTypeIds.indexOf(searchTypeId);
        final MultiSearchResult.MultiSearchResponse multiSearchResponse = result.getResponses().get(searchTypeIndex);
        if (multiSearchResponse.isError) {
            ElasticsearchException e = JestUtils.specificException(() -> "Search type returned error: ", multiSearchResponse.error);
            queryContext.addError(SearchTypeErrorParser.parse(query, searchTypeId, e));
        } else if (checkForFailedShards(multiSearchResponse.searchResult).isPresent()) {
            ElasticsearchException e = checkForFailedShards(multiSearchResponse.searchResult).get();
            queryContext.addError(SearchTypeErrorParser.parse(query, searchTypeId, e));
        } else {
            final SearchType.Result searchTypeResult = handler.extractResult(job, query, searchType, multiSearchResponse.searchResult, queryContext);
            if (searchTypeResult != null) {
                resultsMap.put(searchTypeId, searchTypeResult);
            }
        }
    }
    LOG.debug("Query {} ran for job {}", query.id(), job.getId());
    return QueryResult.builder().query(query).searchTypes(resultsMap).errors(new HashSet<>(queryContext.errors())).build();
}
Also used : AndFilter(org.graylog.plugins.views.search.filter.AndFilter) BackendQuery(org.graylog.plugins.views.search.engine.BackendQuery) QueryBackend(org.graylog.plugins.views.search.engine.QueryBackend) Provider(javax.inject.Provider) LoggerFactory(org.slf4j.LoggerFactory) MultiSearchResult(io.searchbox.core.MultiSearchResult) JestUtils(org.graylog.storage.elasticsearch6.jest.JestUtils) StreamFilter(org.graylog.plugins.views.search.filter.StreamFilter) Map(java.util.Map) IndexMapping(org.graylog2.indexer.IndexMapping) QueryBuilders(org.graylog.shaded.elasticsearch6.org.elasticsearch.index.query.QueryBuilders) TimeRangeQueryFactory(org.graylog.storage.elasticsearch6.TimeRangeQueryFactory) SearchConfig(org.graylog.plugins.views.search.engine.SearchConfig) JestUtils.checkForFailedShards(org.graylog.storage.elasticsearch6.jest.JestUtils.checkForFailedShards) Set(java.util.Set) Collectors(java.util.stream.Collectors) Objects(java.util.Objects) List(java.util.List) Filter(org.graylog.plugins.views.search.Filter) Optional(java.util.Optional) SearchSourceBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.builder.SearchSourceBuilder) ESSearchTypeHandler(org.graylog.storage.elasticsearch6.views.searchtypes.ESSearchTypeHandler) Query(org.graylog.plugins.views.search.Query) SearchTypeErrorParser(org.graylog.plugins.views.search.errors.SearchTypeErrorParser) HashMap(java.util.HashMap) ElasticsearchException(org.graylog2.indexer.ElasticsearchException) ArrayList(java.util.ArrayList) JestClient(io.searchbox.client.JestClient) GlobalOverride(org.graylog.plugins.views.search.GlobalOverride) Inject(javax.inject.Inject) HashSet(java.util.HashSet) OrFilter(org.graylog.plugins.views.search.filter.OrFilter) SearchType(org.graylog.plugins.views.search.SearchType) QueryStringFilter(org.graylog.plugins.views.search.filter.QueryStringFilter) SearchTypeError(org.graylog.plugins.views.search.errors.SearchTypeError) QueryResult(org.graylog.plugins.views.search.QueryResult) QueryBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.index.query.QueryBuilder) MultiSearch(io.searchbox.core.MultiSearch) SearchJob(org.graylog.plugins.views.search.SearchJob) Logger(org.slf4j.Logger) ObjectMapper(com.fasterxml.jackson.databind.ObjectMapper) Search(io.searchbox.core.Search) Maps(com.google.common.collect.Maps) QueryStringDecorators(org.graylog.plugins.views.search.elasticsearch.QueryStringDecorators) Named(com.google.inject.name.Named) BoolQueryBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.index.query.BoolQueryBuilder) IndexLookup(org.graylog.plugins.views.search.elasticsearch.IndexLookup) Message(org.graylog2.plugin.Message) Collections(java.util.Collections) Set(java.util.Set) HashSet(java.util.HashSet) SearchSourceBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.builder.SearchSourceBuilder) QueryBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.index.query.QueryBuilder) BoolQueryBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.index.query.BoolQueryBuilder) ArrayList(java.util.ArrayList) ElasticsearchException(org.graylog2.indexer.ElasticsearchException) MultiSearchResult(io.searchbox.core.MultiSearchResult) QueryResult(org.graylog.plugins.views.search.QueryResult) SearchSourceBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.builder.SearchSourceBuilder) MultiSearch(io.searchbox.core.MultiSearch) Search(io.searchbox.core.Search) SearchType(org.graylog.plugins.views.search.SearchType) HashSet(java.util.HashSet) MultiSearchResult(io.searchbox.core.MultiSearchResult) MultiSearch(io.searchbox.core.MultiSearch) GlobalOverride(org.graylog.plugins.views.search.GlobalOverride) ESSearchTypeHandler(org.graylog.storage.elasticsearch6.views.searchtypes.ESSearchTypeHandler) GlobalOverride(org.graylog.plugins.views.search.GlobalOverride)

Aggregations

QueryResult (org.graylog.plugins.views.search.QueryResult)18 Test (org.junit.Test)10 SearchJob (org.graylog.plugins.views.search.SearchJob)7 Query (org.graylog.plugins.views.search.Query)6 SearchConfig (org.graylog.plugins.views.search.engine.SearchConfig)6 SearchError (org.graylog.plugins.views.search.errors.SearchError)6 PivotResult (org.graylog.plugins.views.search.searchtypes.pivot.PivotResult)6 ArrayList (java.util.ArrayList)5 SearchTypeError (org.graylog.plugins.views.search.errors.SearchTypeError)5 MultiSearchResponse (org.graylog.shaded.elasticsearch7.org.elasticsearch.action.search.MultiSearchResponse)5 Optional (java.util.Optional)4 Set (java.util.Set)4 SearchType (org.graylog.plugins.views.search.SearchType)4 QueryError (org.graylog.plugins.views.search.errors.QueryError)4 MultiSearchResult (io.searchbox.core.MultiSearchResult)3 Collections (java.util.Collections)3 List (java.util.List)3 Objects (java.util.Objects)3 Collectors (java.util.stream.Collectors)3 GlobalOverride (org.graylog.plugins.views.search.GlobalOverride)3