Examples with SearchResult org.apache.metron.indexing.dao.search.SearchResult used on opensource projects

Example 1 with SearchResult

use of org.apache.metron.indexing.dao.search.SearchResult in project metron by apache.

the class ElasticsearchDao method getSearchResult.

private SearchResult getSearchResult(SearchHit searchHit, List<String> fields) {
    SearchResult searchResult = new SearchResult();
    searchResult.setId(searchHit.getId());
    Map<String, Object> source;
    if (fields != null) {
        Map<String, Object> resultSourceAsMap = searchHit.getSourceAsMap();
        source = new HashMap<>();
        fields.forEach(field -> {
            source.put(field, resultSourceAsMap.get(field));
        });
    } else {
        source = searchHit.getSource();
    }
    searchResult.setSource(source);
    searchResult.setScore(searchHit.getScore());
    searchResult.setIndex(searchHit.getIndex());
    return searchResult;
}

Example 2 with SearchResult

use of org.apache.metron.indexing.dao.search.SearchResult in project metron by apache.

the class ElasticsearchDao method buildSearchResponse.

/**
 * Builds a search response.
 *
 * This effectively transforms an Elasticsearch search response into a Metron search response.
 *
 * @param searchRequest The Metron search request.
 * @param esResponse The Elasticsearch search response.
 * @return A Metron search response.
 * @throws InvalidSearchException
 */
private SearchResponse buildSearchResponse(SearchRequest searchRequest, org.elasticsearch.action.search.SearchResponse esResponse) throws InvalidSearchException {
    SearchResponse searchResponse = new SearchResponse();
    searchResponse.setTotal(esResponse.getHits().getTotalHits());
    // search hits --> search results
    List<SearchResult> results = new ArrayList<>();
    for (SearchHit hit : esResponse.getHits().getHits()) {
        results.add(getSearchResult(hit, searchRequest.getFields()));
    }
    searchResponse.setResults(results);
    // handle facet fields
    if (searchRequest.getFacetFields() != null) {
        List<String> facetFields = searchRequest.getFacetFields();
        Map<String, FieldType> commonColumnMetadata;
        try {
            commonColumnMetadata = getColumnMetadata(searchRequest.getIndices());
        } catch (IOException e) {
            throw new InvalidSearchException(String.format("Could not get common column metadata for indices %s", Arrays.toString(searchRequest.getIndices().toArray())));
        }
        searchResponse.setFacetCounts(getFacetCounts(facetFields, esResponse.getAggregations(), commonColumnMetadata));
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("Built search response; response={}", ElasticsearchUtils.toJSON(searchResponse).orElse("???"));
    }
    return searchResponse;
}

Example 3 with SearchResult

use of org.apache.metron.indexing.dao.search.SearchResult in project metron by apache.

the class ElasticsearchMetaAlertDao method update.

@Override
public void update(Document update, Optional<String> index) throws IOException {
    if (METAALERT_TYPE.equals(update.getSensorType())) {
        // We've been passed an update to the meta alert.
        throw new UnsupportedOperationException("Meta alerts cannot be directly updated");
    } else {
        Map<Document, Optional<String>> updates = new HashMap<>();
        updates.put(update, index);
        // We need to update an alert itself.  Only that portion of the update can be delegated.
        // We still need to get meta alerts potentially associated with it and update.
        Collection<Document> metaAlerts = getMetaAlertsForAlert(update.getGuid()).getResults().stream().map(searchResult -> new Document(searchResult.getSource(), searchResult.getId(), METAALERT_TYPE, 0L)).collect(Collectors.toList());
        // Each meta alert needs to be updated with the new alert
        for (Document metaAlert : metaAlerts) {
            replaceAlertInMetaAlert(metaAlert, update);
            updates.put(metaAlert, Optional.of(METAALERTS_INDEX));
        }
        // Run the alert's update
        indexDao.batchUpdate(updates);
    }
}

Example 4 with SearchResult

use of org.apache.metron.indexing.dao.search.SearchResult in project metron by apache.

the class ElasticsearchMetaAlertIntegrationTest method shouldGetAllMetaAlertsForAlert.

@Test
public void shouldGetAllMetaAlertsForAlert() throws Exception {
    // Load alerts
    List<Map<String, Object>> alerts = buildAlerts(3);
    elasticsearchAdd(alerts, INDEX, SENSOR_NAME);
    // Load metaAlerts
    List<Map<String, Object>> metaAlerts = buildMetaAlerts(12, MetaAlertStatus.ACTIVE, Optional.of(Collections.singletonList(alerts.get(0))));
    metaAlerts.add(buildMetaAlert("meta_active_12", MetaAlertStatus.ACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    metaAlerts.add(buildMetaAlert("meta_inactive", MetaAlertStatus.INACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    // We pass MetaAlertDao.METAALERT_TYPE, because the "_doc" gets appended automatically.
    elasticsearchAdd(metaAlerts, METAALERTS_INDEX, MetaAlertDao.METAALERT_TYPE);
    // Verify load was successful
    List<GetRequest> createdDocs = metaAlerts.stream().map(metaAlert -> new GetRequest((String) metaAlert.get(Constants.GUID), METAALERT_TYPE)).collect(Collectors.toList());
    createdDocs.addAll(alerts.stream().map(alert -> new GetRequest((String) alert.get(Constants.GUID), SENSOR_NAME)).collect(Collectors.toList()));
    findCreatedDocs(createdDocs);
    int previousPageSize = ((ElasticsearchMetaAlertDao) metaDao).getPageSize();
    ((ElasticsearchMetaAlertDao) metaDao).setPageSize(5);
    {
        // Verify searches successfully return more than 10 results
        SearchResponse searchResponse0 = metaDao.getAllMetaAlertsForAlert("message_0");
        List<SearchResult> searchResults0 = searchResponse0.getResults();
        Assert.assertEquals(13, searchResults0.size());
        Set<Map<String, Object>> resultSet = new HashSet<>();
        Iterables.addAll(resultSet, Iterables.transform(searchResults0, r -> r.getSource()));
        StringBuffer reason = new StringBuffer("Unable to find " + metaAlerts.get(0) + "\n");
        reason.append(Joiner.on("\n").join(resultSet));
        Assert.assertTrue(reason.toString(), resultSet.contains(metaAlerts.get(0)));
        // Verify no meta alerts are returned because message_1 was not added to any
        SearchResponse searchResponse1 = metaDao.getAllMetaAlertsForAlert("message_1");
        List<SearchResult> searchResults1 = searchResponse1.getResults();
        Assert.assertEquals(0, searchResults1.size());
        // Verify only the meta alert message_2 was added to is returned
        SearchResponse searchResponse2 = metaDao.getAllMetaAlertsForAlert("message_2");
        List<SearchResult> searchResults2 = searchResponse2.getResults();
        Assert.assertEquals(1, searchResults2.size());
        Assert.assertEquals(metaAlerts.get(12), searchResults2.get(0).getSource());
    }
    ((ElasticsearchMetaAlertDao) metaDao).setPageSize(previousPageSize);
}

Example 5 with SearchResult

use of org.apache.metron.indexing.dao.search.SearchResult in project metron by apache.

the class InMemoryDao method search.

@Override
public SearchResponse search(SearchRequest searchRequest) throws InvalidSearchException {
    if (config.getMaxSearchResults() != null && searchRequest.getSize() > config.getMaxSearchResults()) {
        throw new InvalidSearchException("Search result size must be less than " + config.getMaxSearchResults());
    }
    List<SearchResult> response = new ArrayList<>();
    for (String index : searchRequest.getIndices()) {
        String i = null;
        for (String storedIdx : BACKING_STORE.keySet()) {
            if (storedIdx.equals(index) || storedIdx.startsWith(index + "_")) {
                i = storedIdx;
            }
        }
        if (i == null) {
            continue;
        }
        for (String doc : BACKING_STORE.get(i)) {
            Map<String, Object> docParsed = parse(doc);
            if (isMatch(searchRequest.getQuery(), docParsed)) {
                SearchResult result = new SearchResult();
                result.setSource(docParsed);
                result.setScore((float) Math.random());
                result.setId(docParsed.getOrDefault(Constants.GUID, UUID.randomUUID()).toString());
                response.add(result);
            }
        }
    }
    if (searchRequest.getSort().size() != 0) {
        Collections.sort(response, sorted(searchRequest.getSort()));
    }
    SearchResponse ret = new SearchResponse();
    List<SearchResult> finalResp = new ArrayList<>();
    int maxSize = config.getMaxSearchResults() == null ? searchRequest.getSize() : config.getMaxSearchResults();
    for (int i = searchRequest.getFrom(); i < response.size() && finalResp.size() <= maxSize; ++i) {
        finalResp.add(response.get(i));
    }
    ret.setTotal(response.size());
    ret.setResults(finalResp);
    Map<String, Map<String, Long>> facetCounts = new HashMap<>();
    List<String> facetFields = searchRequest.getFacetFields();
    if (facetFields != null) {
        for (String facet : facetFields) {
            facetCounts.put(facet, FACET_COUNTS.get(facet));
        }
        ret.setFacetCounts(facetCounts);
    }
    return ret;
}