plunk 0.2.6 → 0.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1bc1207f69f06280c177f65cdce11a259502ac58
-  data.tar.gz: 909ee371c459abed454a019ac37f46fd48c3bfd5
+  metadata.gz: 3408599e2af768132c73ca5baaee9e664a3a4e7d
+  data.tar.gz: ae781102e75198bbcc8645fd1ae16e6bcd5e00b2
 SHA512:
-  metadata.gz: b45c80c41996d29e5391ab23368e27e50de2c00780d1d652d95adbf60c20ef471830821f3bfd4e8e0a1f8d12ff5041edb7b8d90782f80380e4a7633aa0fede4a
-  data.tar.gz: 8a6d79f487a627265335408439504726f5293e7e1ec8f81e275da83110e8cf55ad0b80f35e0af25baba46c3cf6c63b2c09fcf8864a538e7e91f9a2b83eac5757
+  metadata.gz: 8c82d20b434eb7a3e37272ea66ed0f70476469e8ee1b6871676f0aca673a6e21152fc2d59e75b8856ca160ce15778f05458616e7299de5c50bc9f97594de011a
+  data.tar.gz: b457cc61a5efa0b7aa7b926a5f8fefe3accc6bc7036955ed604494c71d1709caa66fd1b131c6f58e0d0dde741a4f8b229ad28bf695a9a95b9022484e9016950e

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    plunk (0.2.5)
+    plunk (0.2.6)
       activesupport
       elasticsearch
       json

data/lib/plunk/parser.rb

@@ -48,7 +48,7 @@ module Plunk
     # possible right-hand side values
     rule(:wildcard)   { match('[^=\s)(|]').repeat(1) }
     rule(:searchop)   { match('[=]').as(:op) }
-    rule(:query_value) { number | string | datetime | wildcard }
+    rule(:query_value) { string | wildcard | datetime | number }
 
     # boolean operators search
     rule(:concatop)   { (str('OR') | str('AND')) >> space? }

data/plunk.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name                    = "plunk"
-  s.version                 = "0.2.6"
+  s.version                 = "0.2.7"
   s.add_runtime_dependency  "json"
   s.add_runtime_dependency  "parslet"
   s.add_runtime_dependency  "elasticsearch"

data/spec/chained_search_spec.rb

@@ -1,28 +1,60 @@
 require 'spec_helper'
+require 'shared/time_stubs'
+require 'shared/plunk_stubs'
 
 describe 'chained searches' do
-  it 'should parse last 24h foo=bar baz=fez' do
-    parsed = @parser.parse 'last 24h foo=bar baz=fez ham=delicious'
+  include_context "time stubs"
+  include_context "plunk stubs"
+
+  before :each do
+    @time = Time.parse("01/01/2010 10:00")
+    Time.any_instance.stub(:now).and_return(@time)
+  end
+
+  it 'should parse last 24h foo_type=bar baz="fez" host=27.224.123.110' do
+    parsed = @parser.parse 'last 24h foo_type=bar baz="fez" host=27.224.123.110'
+    result = @transformer.apply parsed
+    expect(result.query).to eq({query:{filtered:{query:{
+      query_string: {
+        query: 'foo_type:bar'
+      }},
+      filter: {
+        and: [{
+          range: {
+            :timestamp => {
+              gte: @time - 24.hours,
+              lte: @time
+            }
+          }},
+          {query_string: {
+            query: 'baz:fez'
+          }},
+          {query_string: {
+            query: 'host:27.224.123.110'
+          }}
+    ]}}}})
+  end
+
+  pending 'should parse last 24h (foo_type=bar AND baz="fez" AND host=27.224.123.110)' do
+    parsed = @parser.parse 'last 24h (foo_type=bar AND baz="fez" AND host=27.224.123.110)'
     result = @transformer.apply parsed
-    puts "PARSED: #{parsed}"
-    puts "RESULT_SET: #{result.inspect}"
     expect(result.query).to eq({query:{filtered:{query:{
       query_string: {
-        query: 'foo:bar'
+        query: 'foo_type:bar'
       }},
       filter: {
         and: [{
           range: {
             :timestamp => {
               gte: 1.day.ago.utc.iso8601(3),
-              lte: Time.now.utc.iso8601(3)
+              lte: @time
             }
           }},
           {query_string: {
             query: 'baz:fez'
           }},
           {query_string: {
-            query: 'ham:delicious'
+            query: 'host:27.224.123.110'
           }}
     ]}}}})
   end

data/spec/last_spec.rb

@@ -1,13 +1,18 @@
 require 'spec_helper'
+require 'shared/time_stubs'
+require 'shared/plunk_stubs'
 
 describe 'the last command' do
+  include_context "time stubs"
+  include_context "plunk stubs"
+
   it 'should parse last 24h' do
     result = @transformer.apply @parser.parse('last 24h')
     expect(result.query.to_s).to eq({query:{filtered:{query:{
       range: {
         Plunk.timestamp_field => {
-          gte: 24.hours.ago.utc.to_datetime.iso8601(3),
-          lte: Time.now.utc.to_datetime.iso8601(3)
+          gte: @time - 24.hours,
+          lte: @time
     }}}}}}.to_s)
   end
 
@@ -16,8 +21,8 @@ describe 'the last command' do
     expect(result.query.to_s).to eq({query:{filtered:{query:{
       range: {
         Plunk.timestamp_field => {
-          gte: 24.days.ago.utc.to_datetime.iso8601(3),
-          lte: Time.now.utc.to_datetime.iso8601(3)
+          gte: @time - 24.days,
+          lte: @time
     }}}}}}.to_s)
   end
 
@@ -26,8 +31,8 @@ describe 'the last command' do
     expect(result.query.to_s).to eq({query:{filtered:{query:{
       range: {
         Plunk.timestamp_field => {
-          gte: 24.weeks.ago.utc.to_datetime.iso8601(3),
-          lte: Time.now.utc.to_datetime.iso8601(3)
+          gte: @time - 24.weeks,
+          lte: @time
     }}}}}}.to_s)
   end
 
@@ -36,8 +41,8 @@ describe 'the last command' do
     expect(result.query.to_s).to eq({query:{filtered:{query:{
       range: {
         Plunk.timestamp_field => {
-          gte: 24.seconds.ago.utc.to_datetime.iso8601(3),
-          lte: Time.now.utc.to_datetime.iso8601(3)
+          gte: @time - 24.seconds,
+          lte: @time
     }}}}}}.to_s)
   end
 
@@ -46,8 +51,8 @@ describe 'the last command' do
     expect(result.query.to_s).to eq({query:{filtered:{query:{
       range: {
         Plunk.timestamp_field => {
-          gte: 24.minutes.ago.utc.to_datetime.iso8601(3),
-          lte: Time.now.utc.to_datetime.iso8601(3)
+          gte: @time - 24.minutes,
+          lte: @time
     }}}}}}.to_s)
   end
 
@@ -62,8 +67,8 @@ describe 'the last command' do
         and: [
           range: {
             Plunk.timestamp_field => {
-              gte: 1.hour.ago.utc.to_datetime.iso8601(3),
-              lte: Time.now.utc.to_datetime.iso8601(3)
+              gte: @time - 1.hour,
+              lte: @time
     }}]}}}}.to_s)
   end
 end

data/spec/nested_search_spec.rb

@@ -1,12 +1,17 @@
 require 'spec_helper'
+require 'shared/time_stubs'
+require 'shared/plunk_stubs'
 
 describe 'nested searches' do
+  include_context "time stubs"
+  include_context "plunk stubs"
+  
   before :each do
     fake_results = {
       foo: 'bar',
       baz: 5,
       arr: [ 0, 1, 2, 3 ],
-      :timestamp => Time.now.utc.iso8601(3)
+      :timestamp => @time
     }.to_json
     Plunk::ResultSet.any_instance.stub(:eval).and_return(fake_results)
   end
@@ -22,7 +27,7 @@ describe 'nested searches' do
     @parsed = @parser.parse 'tshark.len = ` 226 | tshark.frame.time_epoch,tshark.ip.src`'
     expect(@parsed[:field].to_s).to eq 'tshark.len'
     expect(@parsed[:op].to_s).to eq '='
-    expect(@parsed[:value][:initial_query][:match].to_s).to eq '226 '
+    expect(@parsed[:value][:initial_query][:match].to_s).to eq '226'
     expect(@parsed[:value][:extractors].to_s).to eq 'tshark.frame.time_epoch,tshark.ip.src'
   end
 

data/spec/shared/plunk_stubs.rb

@@ -0,0 +1,5 @@
+shared_context "plunk stubs" do
+  before :each do
+    Plunk.any_instance.stub(:timestamp_field).and_return(:@timestamp)
+  end
+end

data/spec/shared/time_stubs.rb

@@ -0,0 +1,6 @@
+shared_context "time stubs" do
+  before :each do
+    @time = Time.parse("01/01/2010 10:00")
+    Time.any_instance.stub(:now).and_return(@time)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: plunk
 version: !ruby/object:Gem::Version
-  version: 0.2.6
+  version: 0.2.7
 platform: ruby
 authors:
 - Ram Mehta
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-28 00:00:00.000000000 Z
+date: 2014-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -113,6 +113,8 @@ files:
 - spec/shared/basic.rb
 - spec/shared/field_value.rb
 - spec/shared/last.rb
+- spec/shared/plunk_stubs.rb
+- spec/shared/time_stubs.rb
 - spec/spec_helper.rb
 homepage: https://github.com/elbii/plunk
 licenses: