Examples with Event org.graylog.events.event.Event used on opensource projects

Example 1 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class AggregationEventProcessor method sourceMessagesForEvent.

@Override
public void sourceMessagesForEvent(Event event, Consumer<List<MessageSummary>> messageConsumer, long limit) throws EventProcessorException {
    if (config.series().isEmpty()) {
        if (limit <= 0) {
            return;
        }
        final EventOriginContext.ESEventOriginContext esContext = EventOriginContext.parseESContext(event.getOriginContext()).orElseThrow(() -> new EventProcessorException("Failed to parse origin context", false, eventDefinition));
        try {
            final ResultMessage message;
            message = messages.get(esContext.messageId(), esContext.indexName());
            messageConsumer.accept(Lists.newArrayList(new MessageSummary(message.getIndex(), message.getMessage())));
        } catch (IOException e) {
            throw new EventProcessorException("Failed to query origin context message", false, eventDefinition, e);
        }
    } else {
        final AtomicLong msgCount = new AtomicLong(0L);
        final MoreSearch.ScrollCallback callback = (messages, continueScrolling) -> {
            final List<MessageSummary> summaries = Lists.newArrayList();
            for (final ResultMessage resultMessage : messages) {
                if (msgCount.incrementAndGet() > limit) {
                    continueScrolling.set(false);
                    break;
                }
                final Message msg = resultMessage.getMessage();
                summaries.add(new MessageSummary(resultMessage.getIndex(), msg));
            }
            messageConsumer.accept(summaries);
        };
        ElasticsearchQueryString scrollQueryString = ElasticsearchQueryString.of(config.query());
        scrollQueryString = scrollQueryString.concatenate(groupByQueryString(event));
        LOG.debug("scrollQueryString: {}", scrollQueryString);
        final TimeRange timeRange = AbsoluteRange.create(event.getTimerangeStart(), event.getTimerangeEnd());
        moreSearch.scrollQuery(scrollQueryString.queryString(), config.streams(), config.queryParameters(), timeRange, Math.min(500, Ints.saturatedCast(limit)), callback);
    }
}

Example 2 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class AggregationEventProcessorTest method testEventsFromAggregationResultWithEmptyResultUsesEventDefinitionStreamAsSourceStreams.

@Test
public void testEventsFromAggregationResultWithEmptyResultUsesEventDefinitionStreamAsSourceStreams() {
    final DateTime now = DateTime.now(DateTimeZone.UTC);
    final AbsoluteRange timerange = AbsoluteRange.create(now.minusHours(1), now.plusHours(1));
    // We expect to get the end of the aggregation timerange as event time
    final TestEvent event1 = new TestEvent(timerange.to());
    final TestEvent event2 = new TestEvent(timerange.to());
    when(eventFactory.createEvent(any(EventDefinition.class), eq(now), anyString())).thenReturn(// first invocation return value
    event1).thenReturn(// second invocation return value
    event2);
    final EventDefinitionDto eventDefinitionDto = buildEventDefinitionDto(ImmutableSet.of("stream-2"), ImmutableList.of(), null);
    final AggregationEventProcessorParameters parameters = AggregationEventProcessorParameters.builder().timerange(timerange).build();
    final AggregationEventProcessor eventProcessor = new AggregationEventProcessor(eventDefinitionDto, searchFactory, eventProcessorDependencyCheck, stateService, moreSearch, streamService, messages);
    final AggregationResult result = buildAggregationResult(timerange, now, ImmutableList.of("one", "two"));
    final ImmutableList<EventWithContext> eventsWithContext = eventProcessor.eventsFromAggregationResult(eventFactory, parameters, result);
    assertThat(eventsWithContext).hasSize(1);
    assertThat(eventsWithContext.get(0)).satisfies(eventWithContext -> {
        final Event event = eventWithContext.event();
        assertThat(event.getId()).isEqualTo(event1.getId());
        assertThat(event.getMessage()).isEqualTo(event1.getMessage());
        assertThat(event.getEventTimestamp()).isEqualTo(timerange.to());
        assertThat(event.getTimerangeStart()).isEqualTo(timerange.from());
        assertThat(event.getTimerangeEnd()).isEqualTo(timerange.to());
        // Must contain the stream from the event definition because there is none in the result
        assertThat(event.getSourceStreams()).containsOnly("stream-2");
        final Message message = eventWithContext.messageContext().orElse(null);
        assertThat(message).isNotNull();
        assertThat(message.getField("group_field_one")).isEqualTo("one");
        assertThat(message.getField("group_field_two")).isEqualTo("two");
        assertThat(message.getField("aggregation_key")).isEqualTo("one|two");
        assertThat(message.getField("aggregation_value_count")).isEqualTo(0.0d);
    });
}

Example 3 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class NotificationGracePeriodServiceTest method emptyKey.

@Test
public void emptyKey() {
    final NotificationGracePeriodService notificationGracePeriodService = new NotificationGracePeriodService();
    when(settings.gracePeriodMs()).thenReturn(10L);
    when(definition.notificationSettings()).thenReturn(settings);
    when(definition.id()).thenReturn("1234");
    final Event event = new TestEvent();
    event.setKeyTuple(ImmutableList.of());
    final Event event2 = new TestEvent();
    event.setKeyTuple(ImmutableList.of());
    event2.setEventTimestamp(event.getEventTimestamp().plus(1L));
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event)).isFalse();
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event2)).isTrue();
}

Example 4 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class NotificationGracePeriodServiceTest method falseWithDisabledGracePeriod.

@Test
public void falseWithDisabledGracePeriod() {
    final NotificationGracePeriodService notificationGracePeriodService = new NotificationGracePeriodService();
    when(settings.gracePeriodMs()).thenReturn(0L);
    when(definition.notificationSettings()).thenReturn(settings);
    when(definition.id()).thenReturn("1234");
    final Event event = new TestEvent();
    event.setKeyTuple(ImmutableList.of("testkey"));
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event)).isFalse();
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event)).isFalse();
}

Example 5 with Event

use of org.graylog.events.event.Event in project graylog2-server by Graylog2.

the class NotificationGracePeriodServiceTest method differentKey.

@Test
public void differentKey() {
    final NotificationGracePeriodService notificationGracePeriodService = new NotificationGracePeriodService();
    when(settings.gracePeriodMs()).thenReturn(10L);
    when(definition.notificationSettings()).thenReturn(settings);
    when(definition.id()).thenReturn("1234");
    final Event event = new TestEvent();
    event.setKeyTuple(ImmutableList.of("testkey"));
    final Event event2 = new TestEvent();
    event2.setKeyTuple(ImmutableList.of("otherkey"));
    event2.setEventTimestamp(event.getEventTimestamp().plus(1L));
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event)).isFalse();
    assertThat(notificationGracePeriodService.inGracePeriod(definition, "5678", event2)).isFalse();
}