use of org.apache.metron.indexing.dao.search.GroupResponse in project metron by apache.
the class SearchIntegrationTest method group_by_ip_query.
@Test
public void group_by_ip_query() throws Exception {
GroupRequest request = JSONUtils.INSTANCE.load(groupByIpQuery, GroupRequest.class);
GroupResponse response = dao.group(request);
// expect only 1 group for 'ip_src_addr'
Assert.assertEquals("ip_src_addr", response.getGroupedBy());
// there are 8 different 'ip_src_addr' values
List<GroupResult> groups = response.getGroupResults();
Assert.assertEquals(8, groups.size());
// expect dotted-decimal notation in descending order
Assert.assertEquals("192.168.1.8", groups.get(0).getKey());
Assert.assertEquals("192.168.1.7", groups.get(1).getKey());
Assert.assertEquals("192.168.1.6", groups.get(2).getKey());
Assert.assertEquals("192.168.1.5", groups.get(3).getKey());
Assert.assertEquals("192.168.1.4", groups.get(4).getKey());
Assert.assertEquals("192.168.1.3", groups.get(5).getKey());
Assert.assertEquals("192.168.1.2", groups.get(6).getKey());
Assert.assertEquals("192.168.1.1", groups.get(7).getKey());
}
use of org.apache.metron.indexing.dao.search.GroupResponse in project metron by apache.
the class SearchIntegrationTest method group_by_returns_results_in_groups.
@Test
public void group_by_returns_results_in_groups() throws Exception {
// Group by test case, default order is count descending
GroupRequest request = JSONUtils.INSTANCE.load(groupByQuery, GroupRequest.class);
GroupResponse response = dao.group(request);
Assert.assertEquals("is_alert", response.getGroupedBy());
List<GroupResult> isAlertGroups = response.getGroupResults();
Assert.assertEquals(2, isAlertGroups.size());
// isAlert == true group
GroupResult trueGroup = isAlertGroups.get(0);
Assert.assertEquals("true", trueGroup.getKey());
Assert.assertEquals(6, trueGroup.getTotal());
Assert.assertEquals("latitude", trueGroup.getGroupedBy());
Assert.assertEquals(198.0, trueGroup.getScore(), 0.00001);
List<GroupResult> trueLatitudeGroups = trueGroup.getGroupResults();
Assert.assertEquals(2, trueLatitudeGroups.size());
// isAlert == true && latitude == 48.5839 group
GroupResult trueLatitudeGroup2 = trueLatitudeGroups.get(0);
Assert.assertEquals(48.5839, Double.parseDouble(trueLatitudeGroup2.getKey()), 0.00001);
Assert.assertEquals(5, trueLatitudeGroup2.getTotal());
Assert.assertEquals(148.0, trueLatitudeGroup2.getScore(), 0.00001);
// isAlert == true && latitude == 48.0001 group
GroupResult trueLatitudeGroup1 = trueLatitudeGroups.get(1);
Assert.assertEquals(48.0001, Double.parseDouble(trueLatitudeGroup1.getKey()), 0.00001);
Assert.assertEquals(1, trueLatitudeGroup1.getTotal());
Assert.assertEquals(50.0, trueLatitudeGroup1.getScore(), 0.00001);
// isAlert == false group
GroupResult falseGroup = isAlertGroups.get(1);
Assert.assertEquals("false", falseGroup.getKey());
Assert.assertEquals("latitude", falseGroup.getGroupedBy());
Assert.assertEquals(130.0, falseGroup.getScore(), 0.00001);
List<GroupResult> falseLatitudeGroups = falseGroup.getGroupResults();
Assert.assertEquals(2, falseLatitudeGroups.size());
// isAlert == false && latitude == 48.5839 group
GroupResult falseLatitudeGroup2 = falseLatitudeGroups.get(0);
Assert.assertEquals(48.5839, Double.parseDouble(falseLatitudeGroup2.getKey()), 0.00001);
Assert.assertEquals(3, falseLatitudeGroup2.getTotal());
Assert.assertEquals(80.0, falseLatitudeGroup2.getScore(), 0.00001);
// isAlert == false && latitude == 48.0001 group
GroupResult falseLatitudeGroup1 = falseLatitudeGroups.get(1);
Assert.assertEquals(48.0001, Double.parseDouble(falseLatitudeGroup1.getKey()), 0.00001);
Assert.assertEquals(1, falseLatitudeGroup1.getTotal());
Assert.assertEquals(50.0, falseLatitudeGroup1.getScore(), 0.00001);
}
use of org.apache.metron.indexing.dao.search.GroupResponse in project metron by apache.
the class SearchIntegrationTest method group_by_returns_results_in_sorted_groups.
@Test
public void group_by_returns_results_in_sorted_groups() throws Exception {
// Group by with sorting test case where is_alert is sorted by count ascending and ip_src_addr is sorted by term descending
GroupRequest request = JSONUtils.INSTANCE.load(sortedGroupByQuery, GroupRequest.class);
GroupResponse response = dao.group(request);
Assert.assertEquals("is_alert", response.getGroupedBy());
List<GroupResult> isAlertGroups = response.getGroupResults();
Assert.assertEquals(2, isAlertGroups.size());
// isAlert == false group
GroupResult falseGroup = isAlertGroups.get(0);
Assert.assertEquals(4, falseGroup.getTotal());
Assert.assertEquals("ip_src_addr", falseGroup.getGroupedBy());
List<GroupResult> falseIpSrcAddrGroups = falseGroup.getGroupResults();
Assert.assertEquals(4, falseIpSrcAddrGroups.size());
// isAlert == false && ip_src_addr == 192.168.1.8 group
GroupResult falseIpSrcAddrGroup1 = falseIpSrcAddrGroups.get(0);
Assert.assertEquals("192.168.1.8", falseIpSrcAddrGroup1.getKey());
Assert.assertEquals(1, falseIpSrcAddrGroup1.getTotal());
Assert.assertNull(falseIpSrcAddrGroup1.getGroupedBy());
Assert.assertNull(falseIpSrcAddrGroup1.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.7 group
GroupResult falseIpSrcAddrGroup2 = falseIpSrcAddrGroups.get(1);
Assert.assertEquals("192.168.1.7", falseIpSrcAddrGroup2.getKey());
Assert.assertEquals(1, falseIpSrcAddrGroup2.getTotal());
Assert.assertNull(falseIpSrcAddrGroup2.getGroupedBy());
Assert.assertNull(falseIpSrcAddrGroup2.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.6 group
GroupResult falseIpSrcAddrGroup3 = falseIpSrcAddrGroups.get(2);
Assert.assertEquals("192.168.1.6", falseIpSrcAddrGroup3.getKey());
Assert.assertEquals(1, falseIpSrcAddrGroup3.getTotal());
Assert.assertNull(falseIpSrcAddrGroup3.getGroupedBy());
Assert.assertNull(falseIpSrcAddrGroup3.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.2 group
GroupResult falseIpSrcAddrGroup4 = falseIpSrcAddrGroups.get(3);
Assert.assertEquals("192.168.1.2", falseIpSrcAddrGroup4.getKey());
Assert.assertEquals(1, falseIpSrcAddrGroup4.getTotal());
Assert.assertNull(falseIpSrcAddrGroup4.getGroupedBy());
Assert.assertNull(falseIpSrcAddrGroup4.getGroupResults());
// isAlert == false group
GroupResult trueGroup = isAlertGroups.get(1);
Assert.assertEquals(6, trueGroup.getTotal());
Assert.assertEquals("ip_src_addr", trueGroup.getGroupedBy());
List<GroupResult> trueIpSrcAddrGroups = trueGroup.getGroupResults();
Assert.assertEquals(4, trueIpSrcAddrGroups.size());
// isAlert == false && ip_src_addr == 192.168.1.5 group
GroupResult trueIpSrcAddrGroup1 = trueIpSrcAddrGroups.get(0);
Assert.assertEquals("192.168.1.5", trueIpSrcAddrGroup1.getKey());
Assert.assertEquals(1, trueIpSrcAddrGroup1.getTotal());
Assert.assertNull(trueIpSrcAddrGroup1.getGroupedBy());
Assert.assertNull(trueIpSrcAddrGroup1.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.4 group
GroupResult trueIpSrcAddrGroup2 = trueIpSrcAddrGroups.get(1);
Assert.assertEquals("192.168.1.4", trueIpSrcAddrGroup2.getKey());
Assert.assertEquals(1, trueIpSrcAddrGroup2.getTotal());
Assert.assertNull(trueIpSrcAddrGroup2.getGroupedBy());
Assert.assertNull(trueIpSrcAddrGroup2.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.3 group
GroupResult trueIpSrcAddrGroup3 = trueIpSrcAddrGroups.get(2);
Assert.assertEquals("192.168.1.3", trueIpSrcAddrGroup3.getKey());
Assert.assertEquals(1, trueIpSrcAddrGroup3.getTotal());
Assert.assertNull(trueIpSrcAddrGroup3.getGroupedBy());
Assert.assertNull(trueIpSrcAddrGroup3.getGroupResults());
// isAlert == false && ip_src_addr == 192.168.1.1 group
GroupResult trueIpSrcAddrGroup4 = trueIpSrcAddrGroups.get(3);
Assert.assertEquals("192.168.1.1", trueIpSrcAddrGroup4.getKey());
Assert.assertEquals(3, trueIpSrcAddrGroup4.getTotal());
Assert.assertNull(trueIpSrcAddrGroup4.getGroupedBy());
Assert.assertNull(trueIpSrcAddrGroup4.getGroupResults());
}
use of org.apache.metron.indexing.dao.search.GroupResponse in project metron by apache.
the class ElasticsearchDao method group.
/**
* Defers to a provided {@link org.elasticsearch.index.query.QueryBuilder} for the query.
* @param groupRequest The request defining the parameters of the grouping
* @param queryBuilder The actual query to be run. Intended for if the SearchRequest requires wrapping
* @return The results of the query
* @throws InvalidSearchException When the query is malformed or the current state doesn't allow search
*/
protected GroupResponse group(GroupRequest groupRequest, QueryBuilder queryBuilder) throws InvalidSearchException {
org.elasticsearch.action.search.SearchRequest esRequest;
org.elasticsearch.action.search.SearchResponse esResponse;
if (client == null) {
throw new InvalidSearchException("Uninitialized Dao! You must call init() prior to use.");
}
if (groupRequest.getGroups() == null || groupRequest.getGroups().size() == 0) {
throw new InvalidSearchException("At least 1 group must be provided.");
}
esRequest = buildGroupRequest(groupRequest, queryBuilder);
esResponse = requestSubmitter.submitSearch(esRequest);
GroupResponse response = buildGroupResponse(groupRequest, esResponse);
return response;
}
use of org.apache.metron.indexing.dao.search.GroupResponse in project metron by apache.
the class ElasticsearchDao method buildGroupResponse.
/**
* Build a group response.
* @param groupRequest The original group request.
* @param response The search response.
* @return A group response.
* @throws InvalidSearchException
*/
private GroupResponse buildGroupResponse(GroupRequest groupRequest, org.elasticsearch.action.search.SearchResponse response) throws InvalidSearchException {
// build the search response
Map<String, FieldType> commonColumnMetadata;
try {
commonColumnMetadata = getColumnMetadata(groupRequest.getIndices());
} catch (IOException e) {
throw new InvalidSearchException(String.format("Could not get common column metadata for indices %s", Arrays.toString(groupRequest.getIndices().toArray())));
}
GroupResponse groupResponse = new GroupResponse();
groupResponse.setGroupedBy(groupRequest.getGroups().get(0).getField());
groupResponse.setGroupResults(getGroupResults(groupRequest, 0, response.getAggregations(), commonColumnMetadata));
return groupResponse;
}
Aggregations