use of org.graylog.events.processor.EventProcessorException in project graylog2-server by Graylog2.
the class EventBacklogService method getMessagesForEvent.
public ImmutableList<MessageSummary> getMessagesForEvent(EventDto eventDto, long backlogSize) throws NotFoundException {
if (backlogSize <= 0) {
return ImmutableList.of();
}
final EventProcessor.Factory factory = eventProcessorFactories.get(eventDto.eventDefinitionType());
if (factory == null) {
throw new NotFoundException("Couldn't find event processor factory for type " + eventDto.eventDefinitionType());
}
final EventDefinition eventDefinition = eventDefinitionService.get(eventDto.eventDefinitionId()).orElseThrow(() -> new NotFoundException("Could not find event definintion <" + eventDto.eventDefinitionId() + ">"));
final EventProcessor eventProcessor = factory.create(eventDefinition);
final ImmutableList.Builder<MessageSummary> backlogBuilder = ImmutableList.builder();
try {
eventProcessor.sourceMessagesForEvent(Event.fromDto(eventDto), backlogBuilder::addAll, backlogSize);
} catch (EventProcessorException e) {
// TODO return this error, so it can be included in the notification message?
LOG.error("Failed to query backlog messages for Event {}", eventDto.id(), e);
}
return backlogBuilder.build();
}
use of org.graylog.events.processor.EventProcessorException in project graylog2-server by Graylog2.
the class PivotAggregationSearch method doSearch.
@Override
public AggregationResult doSearch() throws EventProcessorException {
final SearchJob searchJob = getSearchJob(parameters, searchOwner, config.searchWithinMs(), config.executeEveryMs());
final QueryResult queryResult = searchJob.results().get(QUERY_ID);
final QueryResult streamQueryResult = searchJob.results().get(STREAMS_QUERY_ID);
final Set<SearchError> aggregationErrors = firstNonNull(queryResult.errors(), Collections.emptySet());
final Set<SearchError> streamErrors = firstNonNull(streamQueryResult.errors(), Collections.emptySet());
if (!aggregationErrors.isEmpty() || !streamErrors.isEmpty()) {
final Set<SearchError> errors = aggregationErrors.isEmpty() ? streamErrors : aggregationErrors;
errors.forEach(error -> {
if (error instanceof QueryError) {
final QueryError queryError = (QueryError) error;
final String backtrace = queryError.backtrace() != null ? queryError.backtrace() : "";
if (error instanceof EmptyParameterError) {
LOG.debug("Aggregation search query <{}> with empty Parameter: {}\n{}", queryError.queryId(), queryError.description(), backtrace);
} else {
LOG.error("Aggregation search query <{}> returned an error: {}\n{}", queryError.queryId(), queryError.description(), backtrace);
}
} else {
LOG.error("Aggregation search returned an error: {}", error);
}
});
// If we have only EmptyParameterErrors, just return an empty Result
if (!(errors.stream().filter(e -> !(e instanceof EmptyParameterError)).count() > 1)) {
return AggregationResult.empty();
}
if (errors.size() > 1) {
throw new EventProcessorException("Pivot search failed with multiple errors.", false, eventDefinition);
} else {
throw new EventProcessorException(errors.iterator().next().description(), false, eventDefinition);
}
}
final PivotResult pivotResult = (PivotResult) queryResult.searchTypes().get(PIVOT_ID);
final PivotResult streamsResult = (PivotResult) streamQueryResult.searchTypes().get(STREAMS_PIVOT_ID);
return AggregationResult.builder().keyResults(extractValues(pivotResult)).effectiveTimerange(pivotResult.effectiveTimerange()).totalAggregatedMessages(pivotResult.total()).sourceStreams(extractSourceStreams(streamsResult)).build();
}
Aggregations