Examples with FieldTypeException org.graylog2.indexer.FieldTypeException used on opensource projects

Example 1 with FieldTypeException

use of org.graylog2.indexer.FieldTypeException in project graylog2-server by Graylog2.

the class Searches method fieldHistogram.

public HistogramResult fieldHistogram(String query, String field, DateHistogramInterval interval, String filter, TimeRange range, boolean includeCardinality) throws FieldTypeException {
    final DateHistogramBuilder dateHistogramBuilder = AggregationBuilders.dateHistogram(AGG_HISTOGRAM).field("timestamp").subAggregation(AggregationBuilders.stats(AGG_STATS).field(field)).interval(interval.toESInterval());
    if (includeCardinality) {
        dateHistogramBuilder.subAggregation(AggregationBuilders.cardinality(AGG_CARDINALITY).field(field));
    }
    FilterAggregationBuilder builder = AggregationBuilders.filter(AGG_FILTER).subAggregation(dateHistogramBuilder).filter(standardAggregationFilters(range, filter));
    QueryStringQueryBuilder qs = queryStringQuery(query);
    qs.allowLeadingWildcard(configuration.isAllowLeadingWildcardSearches());
    SearchRequestBuilder srb = c.prepareSearch();
    final Set<String> affectedIndices = determineAffectedIndices(range, filter);
    srb.setIndices(affectedIndices.toArray(new String[affectedIndices.size()]));
    srb.setQuery(qs);
    srb.addAggregation(builder);
    SearchResponse r;
    final SearchRequest request = srb.request();
    try {
        r = c.search(request).actionGet();
    } catch (org.elasticsearch.action.search.SearchPhaseExecutionException e) {
        throw new FieldTypeException(e);
    }
    checkForFailedShards(r);
    recordEsMetrics(r, range);
    final Filter f = r.getAggregations().get(AGG_FILTER);
    return new FieldHistogramResult(f.getAggregations().get(AGG_HISTOGRAM), query, request.source(), interval, r.getTook());
}

Example 2 with FieldTypeException

use of org.graylog2.indexer.FieldTypeException in project graylog2-server by Graylog2.

the class ElasticsearchBackend method checkForFailedShards.

private Optional<ElasticsearchException> checkForFailedShards(MultiSearchResponse.Item multiSearchResponse) {
    if (multiSearchResponse.isFailure()) {
        return Optional.of(new ElasticsearchException(multiSearchResponse.getFailureMessage(), multiSearchResponse.getFailure()));
    }
    final SearchResponse searchResponse = multiSearchResponse.getResponse();
    if (searchResponse != null && searchResponse.getFailedShards() > 0) {
        final List<Throwable> shardFailures = Arrays.stream(searchResponse.getShardFailures()).map(ShardOperationFailedException::getCause).collect(Collectors.toList());
        final List<String> nonNumericFieldErrors = shardFailures.stream().filter(shardFailure -> shardFailure.getMessage().contains("Expected numeric type on field")).map(Throwable::getMessage).distinct().collect(Collectors.toList());
        if (!nonNumericFieldErrors.isEmpty()) {
            return Optional.of(new FieldTypeException("Unable to perform search query: ", nonNumericFieldErrors));
        }
        final List<String> errors = shardFailures.stream().map(Throwable::getMessage).distinct().collect(Collectors.toList());
        return Optional.of(new ElasticsearchException("Unable to perform search query: ", errors));
    }
    return Optional.empty();
}

Example 3 with FieldTypeException

use of org.graylog2.indexer.FieldTypeException in project graylog2-server by Graylog2.

the class FieldValueAlertCondition method runCheck.

@Override
public CheckResult runCheck() {
    try {
        final String filter = buildQueryFilter(stream.getId(), query);
        // TODO we don't support cardinality yet
        final FieldStatsResult fieldStatsResult = searches.fieldStats(field, "*", filter, RelativeRange.create(time * 60), false, true, false);
        if (fieldStatsResult.count() == 0) {
            LOG.debug("Alert check <{}> did not match any messages. Returning not triggered.", type);
            return new NegativeCheckResult();
        }
        final double result;
        switch(type) {
            case MEAN:
                result = fieldStatsResult.mean();
                break;
            case MIN:
                result = fieldStatsResult.min();
                break;
            case MAX:
                result = fieldStatsResult.max();
                break;
            case SUM:
                result = fieldStatsResult.sum();
                break;
            case STDDEV:
                result = fieldStatsResult.stdDeviation();
                break;
            default:
                LOG.error("No such field value check type: [{}]. Returning not triggered.", type);
                return new NegativeCheckResult();
        }
        LOG.debug("Alert check <{}> result: [{}]", id, result);
        if (Double.isInfinite(result)) {
            // This happens when there are no ES results/docs.
            LOG.debug("Infinite value. Returning not triggered.");
            return new NegativeCheckResult();
        }
        final boolean triggered;
        switch(thresholdType) {
            case HIGHER:
                triggered = result > threshold.doubleValue();
                break;
            case LOWER:
                triggered = result < threshold.doubleValue();
                break;
            default:
                triggered = false;
        }
        if (triggered) {
            final String resultDescription = "Field " + field + " had a " + type + " of " + decimalFormat.format(result) + " in the last " + time + " minutes with trigger condition " + thresholdType + " than " + decimalFormat.format(threshold) + ". " + "(Current grace time: " + grace + " minutes)";
            final List<MessageSummary> summaries;
            if (getBacklog() > 0) {
                final List<ResultMessage> searchResult = fieldStatsResult.searchHits();
                summaries = Lists.newArrayListWithCapacity(searchResult.size());
                for (ResultMessage resultMessage : searchResult) {
                    final Message msg = resultMessage.getMessage();
                    summaries.add(new MessageSummary(resultMessage.getIndex(), msg));
                }
            } else {
                summaries = Collections.emptyList();
            }
            return new CheckResult(true, this, resultDescription, Tools.nowUTC(), summaries);
        } else {
            return new NegativeCheckResult();
        }
    } catch (InvalidRangeParametersException e) {
        // cannot happen lol
        LOG.error("Invalid timerange.", e);
        return null;
    } catch (FieldTypeException e) {
        LOG.debug("Field [{}] seems not to have a numerical type or doesn't even exist at all. Returning not triggered.", field, e);
        return new NegativeCheckResult();
    }
}

Example 4 with FieldTypeException

use of org.graylog2.indexer.FieldTypeException in project graylog2-server by Graylog2.

the class JestUtils method checkForFailedShards.

public static Optional<ElasticsearchException> checkForFailedShards(JestResult result) {
    // unwrap shard failure due to non-numeric mapping. this happens when searching across index sets
    // if at least one of the index sets comes back with a result, the overall result will have the aggregation
    // but not considered failed entirely. however, if one shard has the error, we will refuse to respond
    // otherwise we would be showing empty graphs for non-numeric fields.
    final JsonNode shards = result.getJsonObject().path("_shards");
    final double failedShards = shards.path("failed").asDouble();
    if (failedShards > 0) {
        final List<String> errors = StreamSupport.stream(shards.path("failures").spliterator(), false).map(failure -> failure.path("reason").path("reason").asText()).filter(s -> !s.isEmpty()).collect(Collectors.toList());
        final List<String> nonNumericFieldErrors = errors.stream().filter(error -> error.startsWith("Expected numeric type on field")).collect(Collectors.toList());
        if (!nonNumericFieldErrors.isEmpty()) {
            return Optional.of(new FieldTypeException("Unable to perform search query: ", deduplicateErrors(nonNumericFieldErrors)));
        }
        return Optional.of(new ElasticsearchException("Unable to perform search query: ", deduplicateErrors(errors)));
    }
    return Optional.empty();
}