Search in sources :

Example 16 with MetricAggregation

use of io.searchbox.core.search.aggregation.MetricAggregation in project graylog2-server by Graylog2.

the class ESPivot method processRows.

/*
        results from elasticsearch are nested so we need to recurse into the aggregation tree, but our result is a table, thus we need
        to keep track of the current row keys manually
         */
private void processRows(PivotResult.Builder resultBuilder, SearchResult searchResult, ESGeneratedQueryContext queryContext, Pivot pivot, List<BucketSpec> remainingRows, ArrayDeque<String> rowKeys, MetricAggregation aggregation) {
    if (remainingRows.isEmpty()) {
        // this is the last row group, so we need to fork into the columns if they exist.
        // being here also means that `rowKeys` contains the maximum number of parts, one for each combination of row bucket keys
        // we will always add the series for this bucket, because that's the entire point of row groups
        final PivotResult.Row.Builder rowBuilder = PivotResult.Row.builder().key(ImmutableList.copyOf(rowKeys));
        // do the same for columns as we did for the rows
        processColumns(rowBuilder, searchResult, queryContext, pivot, pivot.columnGroups(), new ArrayDeque<>(), aggregation);
        // columnKeys is empty, because this is a rollup per row bucket, thus for all columns in that bucket (IOW it's not a leaf!)
        if (pivot.rollup()) {
            processSeries(rowBuilder, searchResult, queryContext, pivot, new ArrayDeque<>(), aggregation, true, "row-leaf");
        }
        resultBuilder.addRow(rowBuilder.source("leaf").build());
    } else {
        // this is not a leaf for the rows, so we add its key to the rowKeys and descend into the aggregation tree
        // afterwards we'll check if we need to add rollup for intermediate buckets. not all clients need them so they can request
        // to not calculate them
        final BucketSpec currentBucket = remainingRows.get(0);
        // this handler should never be missing, because we used it above to generate the query
        // if it is missing for some weird reason, it's ok to fail hard here
        final ESPivotBucketSpecHandler<? extends PivotSpec, ? extends Aggregation> handler = bucketHandlers.get(currentBucket.type());
        final Aggregation aggregationResult = handler.extractAggregationFromResult(pivot, currentBucket, aggregation, queryContext);
        final Stream<ESPivotBucketSpecHandler.Bucket> bucketStream = handler.handleResult(pivot, currentBucket, searchResult, aggregationResult, this, queryContext);
        // for each bucket, recurse and eventually collect all the row keys. once we reach a leaf, we'll end up in the other if branch above
        bucketStream.forEach(bucket -> {
            // push the bucket's key and use its aggregation as the new source for sub-aggregations
            rowKeys.addLast(bucket.key());
            processRows(resultBuilder, searchResult, queryContext, pivot, tail(remainingRows), rowKeys, bucket.aggregation());
            rowKeys.removeLast();
        });
        // also add the series for this row key if the client wants rollups
        if (pivot.rollup()) {
            final PivotResult.Row.Builder rowBuilder = PivotResult.Row.builder().key(ImmutableList.copyOf(rowKeys));
            // columnKeys is empty, because this is a rollup per row bucket, thus for all columns in that bucket (IOW it's not a leaf!)
            processSeries(rowBuilder, searchResult, queryContext, pivot, new ArrayDeque<>(), aggregation, true, "row-inner");
            resultBuilder.addRow(rowBuilder.source("non-leaf").build());
        }
    }
}
Also used : Aggregation(io.searchbox.core.search.aggregation.Aggregation) MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) BucketSpec(org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec)

Example 17 with MetricAggregation

use of io.searchbox.core.search.aggregation.MetricAggregation in project graylog2-server by Graylog2.

the class ESPivotTest method includesCustomNameinResultIfPresent.

@Test
public void includesCustomNameinResultIfPresent() throws InvalidRangeParametersException {
    final ESPivot esPivot = new ESPivot(Collections.emptyMap(), Collections.emptyMap());
    final Pivot pivot = Pivot.builder().id("somePivotId").name("customPivot").series(Collections.emptyList()).rollup(false).build();
    final long documentCount = 424242;
    when(queryResult.getTotal()).thenReturn(documentCount);
    final MetricAggregation mockMetricAggregation = createTimestampRangeAggregations((double) new Date().getTime(), (double) new Date().getTime());
    when(queryResult.getAggregations()).thenReturn(mockMetricAggregation);
    when(query.effectiveTimeRange(pivot)).thenReturn(RelativeRange.create(300));
    final SearchType.Result result = esPivot.doExtractResult(null, query, pivot, queryResult, null, null);
    assertThat(result.name()).contains("customPivot");
}
Also used : MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) Pivot(org.graylog.plugins.views.search.searchtypes.pivot.Pivot) ESPivot(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivot) SearchType(org.graylog.plugins.views.search.SearchType) ESPivot(org.graylog.storage.elasticsearch6.views.searchtypes.pivot.ESPivot) Date(java.util.Date) Test(org.junit.Test)

Example 18 with MetricAggregation

use of io.searchbox.core.search.aggregation.MetricAggregation in project graylog2-server by Graylog2.

the class ESPivotTest method createTimestampRangeAggregations.

private MetricAggregation createTimestampRangeAggregations(Double min, Double max) {
    final MetricAggregation metricAggregation = mock(MetricAggregation.class);
    final MinAggregation timestampMinAggregation = mock(MinAggregation.class);
    when(timestampMinAggregation.getMin()).thenReturn(min);
    final MaxAggregation timestampMaxAggregation = mock(MaxAggregation.class);
    when(timestampMaxAggregation.getMax()).thenReturn(max);
    when(metricAggregation.getMinAggregation("timestamp-min")).thenReturn(timestampMinAggregation);
    when(metricAggregation.getMaxAggregation("timestamp-max")).thenReturn(timestampMaxAggregation);
    return metricAggregation;
}
Also used : MetricAggregation(io.searchbox.core.search.aggregation.MetricAggregation) MinAggregation(io.searchbox.core.search.aggregation.MinAggregation) MaxAggregation(io.searchbox.core.search.aggregation.MaxAggregation)

Aggregations

MetricAggregation (io.searchbox.core.search.aggregation.MetricAggregation)18 Test (org.junit.Test)9 SearchResult (io.searchbox.core.SearchResult)7 TermsAggregation (io.searchbox.core.search.aggregation.TermsAggregation)7 SearchType (org.graylog.plugins.views.search.SearchType)7 PivotResult (org.graylog.plugins.views.search.searchtypes.pivot.PivotResult)5 ArrayList (java.util.ArrayList)4 Date (java.util.Date)4 Aggregation (io.searchbox.core.search.aggregation.Aggregation)3 List (java.util.List)3 Map (java.util.Map)3 AbstractDaoTest (org.finra.herd.dao.AbstractDaoTest)3 ResultTypeIndexSearchResponseDto (org.finra.herd.model.dto.ResultTypeIndexSearchResponseDto)3 TagTypeIndexSearchResponseDto (org.finra.herd.model.dto.TagTypeIndexSearchResponseDto)3 Query (org.graylog.plugins.views.search.Query)3 SearchJob (org.graylog.plugins.views.search.SearchJob)3 ESGeneratedQueryContext (org.graylog.storage.elasticsearch6.views.ESGeneratedQueryContext)3 Optional (java.util.Optional)2 Inject (javax.inject.Inject)2 BucketSpec (org.graylog.plugins.views.search.searchtypes.pivot.BucketSpec)2