use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.
the class InMemoryMetaAlertDao method createMetaAlert.
@SuppressWarnings("unchecked")
@Override
public MetaAlertCreateResponse createMetaAlert(MetaAlertCreateRequest request) throws InvalidCreateException, IOException {
List<GetRequest> alertRequests = request.getAlerts();
if (alertRequests.isEmpty()) {
MetaAlertCreateResponse response = new MetaAlertCreateResponse();
response.setCreated(false);
return response;
}
// Build meta alert json. Give it a reasonable GUID
JSONObject metaAlert = new JSONObject();
String metaAlertGuid = "meta_" + (InMemoryDao.BACKING_STORE.get(MetaAlertDao.METAALERTS_INDEX).size() + 1);
metaAlert.put(GUID, metaAlertGuid);
JSONArray groupsArray = new JSONArray();
groupsArray.addAll(request.getGroups());
metaAlert.put(MetaAlertDao.GROUPS_FIELD, groupsArray);
// Retrieve the alert for each guid
// For the purpose of testing, we're just using guids for the alerts field and grabbing the scores.
JSONArray alertArray = new JSONArray();
List<Double> threatScores = new ArrayList<>();
Collection<String> alertGuids = new ArrayList<>();
for (GetRequest alertRequest : alertRequests) {
SearchRequest searchRequest = new SearchRequest();
searchRequest.setIndices(ImmutableList.of(alertRequest.getIndex().get()));
searchRequest.setQuery("guid:" + alertRequest.getGuid());
try {
SearchResponse searchResponse = search(searchRequest);
List<SearchResult> searchResults = searchResponse.getResults();
if (searchResults.size() > 1) {
throw new InvalidCreateException("Found more than one result for: " + alertRequest.getGuid() + ". Values: " + searchResults);
}
if (searchResults.size() == 1) {
SearchResult result = searchResults.get(0);
alertArray.add(result.getSource());
Double threatScore = Double.parseDouble(result.getSource().getOrDefault(THREAT_FIELD_DEFAULT, "0").toString());
threatScores.add(threatScore);
}
} catch (InvalidSearchException e) {
throw new InvalidCreateException("Unable to find guid: " + alertRequest.getGuid(), e);
}
alertGuids.add(alertRequest.getGuid());
}
metaAlert.put(MetaAlertDao.ALERT_FIELD, alertArray);
metaAlert.putAll(new MetaScores(threatScores).getMetaScores());
metaAlert.put(STATUS_FIELD, MetaAlertStatus.ACTIVE.getStatusString());
// Add the alert to the store, but make sure not to overwrite existing results
InMemoryDao.BACKING_STORE.get(MetaAlertDao.METAALERTS_INDEX).add(metaAlert.toJSONString());
METAALERT_STORE.put(metaAlertGuid, new HashSet<>(alertGuids));
MetaAlertCreateResponse createResponse = new MetaAlertCreateResponse();
createResponse.setGuid(metaAlertGuid);
createResponse.setCreated(true);
return createResponse;
}
use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.
the class SearchIntegrationTest method sort_query_sorts_results_ascending.
@Test
public void sort_query_sorts_results_ascending() throws Exception {
SearchRequest request = JSONUtils.INSTANCE.load(sortQuery, SearchRequest.class);
SearchResponse response = dao.search(request);
Assert.assertEquals(10, response.getTotal());
List<SearchResult> results = response.getResults();
for (int i = 8001; i < 8011; ++i) {
Assert.assertEquals(i, results.get(i - 8001).getSource().get("ip_src_port"));
}
}
use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.
the class SearchIntegrationTest method returns_results_only_for_specified_indices.
@Test
public void returns_results_only_for_specified_indices() throws Exception {
SearchRequest request = JSONUtils.INSTANCE.load(indexQuery, SearchRequest.class);
SearchResponse response = dao.search(request);
Assert.assertEquals(5, response.getTotal());
List<SearchResult> results = response.getResults();
for (int i = 5, j = 0; i > 0; i--, j++) {
Assert.assertEquals("bro", results.get(j).getSource().get("source:type"));
Assert.assertEquals(i, results.get(j).getSource().get("timestamp"));
}
}
use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.
the class SearchIntegrationTest method sort_by_guid.
@Test
public void sort_by_guid() throws Exception {
SearchRequest request = JSONUtils.INSTANCE.load(sortByGuidQuery, SearchRequest.class);
SearchResponse response = dao.search(request);
Assert.assertEquals(5, response.getTotal());
List<SearchResult> results = response.getResults();
for (int i = 0; i < 5; ++i) {
Map<String, Object> source = results.get(i).getSource();
Assert.assertEquals(1, source.size());
Assert.assertEquals(source.get("guid"), "bro_" + (i + 1));
}
}
use of org.apache.metron.indexing.dao.search.SearchResponse in project metron by apache.
the class SearchIntegrationTest method queries_fields.
@Test
public void queries_fields() throws Exception {
SearchRequest request = JSONUtils.INSTANCE.load(fieldsQuery, SearchRequest.class);
SearchResponse response = dao.search(request);
Assert.assertEquals(10, response.getTotal());
List<SearchResult> results = response.getResults();
for (int i = 0; i < 5; ++i) {
Map<String, Object> source = results.get(i).getSource();
Assert.assertEquals(1, source.size());
Assert.assertNotNull(source.get("ip_src_addr"));
}
for (int i = 5; i < 10; ++i) {
Map<String, Object> source = results.get(i).getSource();
Assert.assertEquals(1, source.size());
Assert.assertNotNull(source.get("ip_src_addr"));
}
}
Aggregations