Search in sources :

Example 1 with Aggregation

use of io.searchbox.core.search.aggregation.Aggregation in project graylog2-server by Graylog2.

the class ESPivot method processSeries.

private void processSeries(PivotResult.Row.Builder rowBuilder, SearchResult searchResult, ESGeneratedQueryContext queryContext, Pivot pivot, ArrayDeque<String> columnKeys, MetricAggregation aggregation, boolean rollup, String source) {
    pivot.series().forEach(seriesSpec -> {
        final ESPivotSeriesSpecHandler<? extends SeriesSpec, ? extends Aggregation> seriesHandler = seriesHandlers.get(seriesSpec.type());
        final Aggregation series = seriesHandler.extractAggregationFromResult(pivot, seriesSpec, aggregation, queryContext);
        seriesHandler.handleResult(pivot, seriesSpec, searchResult, series, this, queryContext).map(value -> {
            columnKeys.addLast(value.id());
            final PivotResult.Value v = PivotResult.Value.create(columnKeys, value.value(), rollup, source);
            columnKeys.removeLast();
            return v;
        }).forEach(rowBuilder::addValue);
    });
}
Also used : Aggregation(io.searchbox.core.search.aggregation.Aggregation) MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) ESGeneratedQueryContext(org.graylog.storage.elasticsearch6.views.ESGeneratedQueryContext) ESSearchTypeHandler(org.graylog.storage.elasticsearch6.views.searchtypes.ESSearchTypeHandler) MinAggregationBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.aggregations.metrics.min.MinAggregationBuilder) DateTimeZone(org.joda.time.DateTimeZone) InvalidRangeParametersException(org.graylog2.plugin.indexer.searches.timeranges.InvalidRangeParametersException) Query(org.graylog.plugins.views.search.Query) PivotResult(org.graylog.plugins.views.search.searchtypes.pivot.PivotResult) LoggerFactory(org.slf4j.LoggerFactory) RelativeRange(org.graylog2.plugin.indexer.searches.timeranges.RelativeRange) Inject(javax.inject.Inject) Tuple2(org.jooq.lambda.tuple.Tuple2) ImmutableList(com.google.common.collect.ImmutableList) SearchType(org.graylog.plugins.views.search.SearchType) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec) SeriesSpec(org.graylog.plugins.views.search.searchtypes.pivot.SeriesSpec) Map(java.util.Map) AbsoluteRange(org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange) MaxAggregationBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.aggregations.metrics.max.MaxAggregationBuilder) AggregationBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.aggregations.AggregationBuilder) Pivot(org.graylog.plugins.views.search.searchtypes.pivot.Pivot) TimeRange(org.graylog2.plugin.indexer.searches.timeranges.TimeRange) PivotSpec(org.graylog.plugins.views.search.searchtypes.pivot.PivotSpec) SearchJob(org.graylog.plugins.views.search.SearchJob) Logger(org.slf4j.Logger) IdentityHashMap(java.util.IdentityHashMap) Iterator(java.util.Iterator) DateTime(org.joda.time.DateTime) Aggregation(io.searchbox.core.search.aggregation.Aggregation) EntryStream(one.util.streamex.EntryStream) List(java.util.List) Tuple(org.jooq.lambda.tuple.Tuple) Stream(java.util.stream.Stream) AggregationBuilders(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.aggregations.AggregationBuilders) MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) Optional(java.util.Optional) Preconditions(com.google.common.base.Preconditions) ArrayDeque(java.util.ArrayDeque) SearchSourceBuilder(org.graylog.shaded.elasticsearch6.org.elasticsearch.search.builder.SearchSourceBuilder) SearchResult(io.searchbox.core.SearchResult)

Example 2 with Aggregation

use of io.searchbox.core.search.aggregation.Aggregation in project graylog2-server by Graylog2.

the class ESPivot method processColumns.

private void processColumns(PivotResult.Row.Builder rowBuilder, SearchResult searchResult, ESGeneratedQueryContext queryContext, Pivot pivot, List<BucketSpec> remainingColumns, ArrayDeque<String> columnKeys, MetricAggregation aggregation) {
    if (remainingColumns.isEmpty()) {
        // with duplicate data entries
        if (!columnKeys.isEmpty()) {
            processSeries(rowBuilder, searchResult, queryContext, pivot, columnKeys, aggregation, false, "col-leaf");
        }
    } else {
        // for a non-leaf column group, we need to recurse further into the aggregation tree
        // and if rollup was requested we'll add intermediate series according to the column keys
        final BucketSpec currentBucket = remainingColumns.get(0);
        // this handler should never be missing, because we used it above to generate the query
        // if it is missing for some weird reason, it's ok to fail hard here
        final ESPivotBucketSpecHandler<? extends PivotSpec, ? extends Aggregation> handler = bucketHandlers.get(currentBucket.type());
        final Aggregation aggregationResult = handler.extractAggregationFromResult(pivot, currentBucket, aggregation, queryContext);
        final Stream<ESPivotBucketSpecHandler.Bucket> bucketStream = handler.handleResult(pivot, currentBucket, searchResult, aggregationResult, this, queryContext);
        // for each bucket, recurse and eventually collect all the column keys. once we reach a leaf, we'll end up in the other if branch above
        bucketStream.forEach(bucket -> {
            // push the bucket's key and use its aggregation as the new source for sub-aggregations
            columnKeys.addLast(bucket.key());
            processColumns(rowBuilder, searchResult, queryContext, pivot, tail(remainingColumns), columnKeys, bucket.aggregation());
            columnKeys.removeLast();
        });
        // don't add the empty column key rollup, because that's not the correct bucket here, it's being done in the row-leaf code
        if (pivot.rollup() && !columnKeys.isEmpty()) {
            // columnKeys is not empty, because this is a rollup per column in a row
            processSeries(rowBuilder, searchResult, queryContext, pivot, columnKeys, aggregation, true, "col-inner");
        }
    }
}
Also used : Aggregation(io.searchbox.core.search.aggregation.Aggregation) MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec)

Example 3 with Aggregation

use of io.searchbox.core.search.aggregation.Aggregation in project graylog2-server by Graylog2.

the class ESPivot method processRows.

/*
        results from elasticsearch are nested so we need to recurse into the aggregation tree, but our result is a table, thus we need
        to keep track of the current row keys manually
         */
private void processRows(PivotResult.Builder resultBuilder, SearchResult searchResult, ESGeneratedQueryContext queryContext, Pivot pivot, List<BucketSpec> remainingRows, ArrayDeque<String> rowKeys, MetricAggregation aggregation) {
    if (remainingRows.isEmpty()) {
        // this is the last row group, so we need to fork into the columns if they exist.
        // being here also means that `rowKeys` contains the maximum number of parts, one for each combination of row bucket keys
        // we will always add the series for this bucket, because that's the entire point of row groups
        final PivotResult.Row.Builder rowBuilder = PivotResult.Row.builder().key(ImmutableList.copyOf(rowKeys));
        // do the same for columns as we did for the rows
        processColumns(rowBuilder, searchResult, queryContext, pivot, pivot.columnGroups(), new ArrayDeque<>(), aggregation);
        // columnKeys is empty, because this is a rollup per row bucket, thus for all columns in that bucket (IOW it's not a leaf!)
        if (pivot.rollup()) {
            processSeries(rowBuilder, searchResult, queryContext, pivot, new ArrayDeque<>(), aggregation, true, "row-leaf");
        }
        resultBuilder.addRow(rowBuilder.source("leaf").build());
    } else {
        // this is not a leaf for the rows, so we add its key to the rowKeys and descend into the aggregation tree
        // afterwards we'll check if we need to add rollup for intermediate buckets. not all clients need them so they can request
        // to not calculate them
        final BucketSpec currentBucket = remainingRows.get(0);
        // this handler should never be missing, because we used it above to generate the query
        // if it is missing for some weird reason, it's ok to fail hard here
        final ESPivotBucketSpecHandler<? extends PivotSpec, ? extends Aggregation> handler = bucketHandlers.get(currentBucket.type());
        final Aggregation aggregationResult = handler.extractAggregationFromResult(pivot, currentBucket, aggregation, queryContext);
        final Stream<ESPivotBucketSpecHandler.Bucket> bucketStream = handler.handleResult(pivot, currentBucket, searchResult, aggregationResult, this, queryContext);
        // for each bucket, recurse and eventually collect all the row keys. once we reach a leaf, we'll end up in the other if branch above
        bucketStream.forEach(bucket -> {
            // push the bucket's key and use its aggregation as the new source for sub-aggregations
            rowKeys.addLast(bucket.key());
            processRows(resultBuilder, searchResult, queryContext, pivot, tail(remainingRows), rowKeys, bucket.aggregation());
            rowKeys.removeLast();
        });
        // also add the series for this row key if the client wants rollups
        if (pivot.rollup()) {
            final PivotResult.Row.Builder rowBuilder = PivotResult.Row.builder().key(ImmutableList.copyOf(rowKeys));
            // columnKeys is empty, because this is a rollup per row bucket, thus for all columns in that bucket (IOW it's not a leaf!)
            processSeries(rowBuilder, searchResult, queryContext, pivot, new ArrayDeque<>(), aggregation, true, "row-inner");
            resultBuilder.addRow(rowBuilder.source("non-leaf").build());
        }
    }
}
Also used : Aggregation(io.searchbox.core.search.aggregation.Aggregation) MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec)

Example 4 with Aggregation

use of io.searchbox.core.search.aggregation.Aggregation in project graylog2-server by Graylog2.

the class ElasticsearchBackendGeneratedRequestTestBase method setUpSUT.

@Before
public void setUpSUT() {
    this.elasticSearchTypeHandlers = new HashMap<>();
    final Map<String, ESPivotBucketSpecHandler<? extends BucketSpec, ? extends Aggregation>> bucketHandlers = Collections.emptyMap();
    final Map<String, ESPivotSeriesSpecHandler<? extends SeriesSpec, ? extends Aggregation>> seriesHandlers = new HashMap<>();
    seriesHandlers.put(Average.NAME, new ESAverageHandler());
    seriesHandlers.put(Max.NAME, new ESMaxHandler());
    elasticSearchTypeHandlers.put(Pivot.NAME, () -> new ESPivot(bucketHandlers, seriesHandlers));
    this.elasticsearchBackend = new ElasticsearchBackend(elasticSearchTypeHandlers, jestClient, indexLookup, new QueryStringDecorators.Fake(), (elasticsearchBackend, ssb, job, query) -> new ESGeneratedQueryContext(elasticsearchBackend, ssb, job, query, fieldTypesLookup), false, objectMapper);
}
Also used : ESSearchTypeHandler(org.graylog.storage.elasticsearch6.views.searchtypes.ESSearchTypeHandler) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) InvalidRangeParametersException(org.graylog2.plugin.indexer.searches.timeranges.InvalidRangeParametersException) Provider(javax.inject.Provider) Query(org.graylog.plugins.views.search.Query) Mock(org.mockito.Mock) JestHttpClient(io.searchbox.client.http.JestHttpClient) ESMaxHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.series.ESMaxHandler) HashMap(java.util.HashMap) Captor(org.mockito.Captor) Max(org.graylog.plugins.views.search.searchtypes.pivot.series.Max) ArgumentCaptor(org.mockito.ArgumentCaptor) SearchType(org.graylog.plugins.views.search.SearchType) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec) SeriesSpec(org.graylog.plugins.views.search.searchtypes.pivot.SeriesSpec) Map(java.util.Map) FieldTypesLookup(org.graylog.plugins.views.search.elasticsearch.FieldTypesLookup) AbsoluteRange(org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange) MockitoJUnit(org.mockito.junit.MockitoJUnit) Search(org.graylog.plugins.views.search.Search) QueryResult(org.graylog.plugins.views.search.QueryResult) Pivot(org.graylog.plugins.views.search.searchtypes.pivot.Pivot) TimeRange(org.graylog2.plugin.indexer.searches.timeranges.TimeRange) ESPivot(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivot) Before(org.junit.Before) MultiSearch(io.searchbox.core.MultiSearch) SearchJob(org.graylog.plugins.views.search.SearchJob) ImmutableSet(com.google.common.collect.ImmutableSet) ESPivotSeriesSpecHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivotSeriesSpecHandler) ESPivotBucketSpecHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivotBucketSpecHandler) Set(java.util.Set) IOException(java.io.IOException) Mockito.times(org.mockito.Mockito.times) Aggregation(io.searchbox.core.search.aggregation.Aggregation) Mockito.verify(org.mockito.Mockito.verify) QueryStringDecorators(org.graylog.plugins.views.search.elasticsearch.QueryStringDecorators) Rule(org.junit.Rule) ESAverageHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.series.ESAverageHandler) MockitoRule(org.mockito.junit.MockitoRule) Average(org.graylog.plugins.views.search.searchtypes.pivot.series.Average) IndexLookup(org.graylog.plugins.views.search.elasticsearch.IndexLookup) Collections(java.util.Collections) ESPivotSeriesSpecHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivotSeriesSpecHandler) HashMap(java.util.HashMap) ESMaxHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.series.ESMaxHandler) SeriesSpec(org.graylog.plugins.views.search.searchtypes.pivot.SeriesSpec) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec) Aggregation(io.searchbox.core.search.aggregation.Aggregation) ESAverageHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.series.ESAverageHandler) ESPivotBucketSpecHandler(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivotBucketSpecHandler) ESPivot(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivot) Before(org.junit.Before)

Aggregations

Aggregation (io.searchbox.core.search.aggregation.Aggregation)4 BucketSpec (org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec)4 MetricAggregation (io.searchbox.core.search.aggregation.MetricAggregation)3 Map (java.util.Map)2 Query (org.graylog.plugins.views.search.Query)2 SearchJob (org.graylog.plugins.views.search.SearchJob)2 SearchType (org.graylog.plugins.views.search.SearchType)2 Pivot (org.graylog.plugins.views.search.searchtypes.pivot.Pivot)2 SeriesSpec (org.graylog.plugins.views.search.searchtypes.pivot.SeriesSpec)2 ESSearchTypeHandler (org.graylog.storage.elasticsearch6.views.searchtypes.ESSearchTypeHandler)2 AbsoluteRange (org.graylog2.plugin.indexer.searches.timeranges.AbsoluteRange)2 InvalidRangeParametersException (org.graylog2.plugin.indexer.searches.timeranges.InvalidRangeParametersException)2 TimeRange (org.graylog2.plugin.indexer.searches.timeranges.TimeRange)2 Preconditions (com.google.common.base.Preconditions)1 ImmutableList (com.google.common.collect.ImmutableList)1 ImmutableSet (com.google.common.collect.ImmutableSet)1 JestHttpClient (io.searchbox.client.http.JestHttpClient)1 MultiSearch (io.searchbox.core.MultiSearch)1 SearchResult (io.searchbox.core.SearchResult)1 IOException (java.io.IOException)1