plunk 0.0.10 → 0.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/plunk/elasticsearch.rb +1 -1
- data/lib/plunk/transformer.rb +5 -4
- data/plunk.gemspec +1 -1
- data/spec/last_spec.rb +14 -0
- data/spec/nested_search_spec.rb +19 -0
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 1f4ae213e6780d0beabd3c1d1595424aa75b041a
|
4
|
+
data.tar.gz: 00bd1c4fab440ccc2bc140f0243f6f9769e0f6f8
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 05df593ab809765d85a480c9a6056599be8b8843023a473c5621cd4d49e878e26e40f168edc5375666de0596600790dfe168c462bac54191efab9b0c2423e1b7
|
7
|
+
data.tar.gz: b5dd04ae58e43e338259f171a421ab9cbc19096675ef78379d62adbf62a86a78c1f1703c270986b0d9669c342985fe1feca2157bf9c922c0ff5ea7118c5676c9
|
data/lib/plunk/elasticsearch.rb
CHANGED
data/lib/plunk/transformer.rb
CHANGED
@@ -10,20 +10,21 @@ class Plunk::Transformer < Parslet::Transform
|
|
10
10
|
rule(
|
11
11
|
field: simple(:field),
|
12
12
|
value: {
|
13
|
-
|
13
|
+
initial_query: subtree(:initial_query),
|
14
14
|
extractors: simple(:extractors)
|
15
15
|
},
|
16
16
|
op: '=') do
|
17
17
|
|
18
|
-
|
18
|
+
# recursively apply nested query
|
19
|
+
result_set = Plunk::Transformer.new.apply(initial_query)
|
19
20
|
|
20
|
-
json = JSON.parse
|
21
|
+
json = JSON.parse result_set.eval
|
21
22
|
values = Plunk::Elasticsearch.extract_values json, extractors.to_s.split(',')
|
22
23
|
|
23
24
|
if values.empty?
|
24
25
|
Plunk::ResultSet.new
|
25
26
|
else
|
26
|
-
Plunk::ResultSet.new(query_string: "(#{values.uniq.join(' OR ')})")
|
27
|
+
Plunk::ResultSet.new(query_string: "#{field}:(#{values.uniq.join(' OR ')})")
|
27
28
|
end
|
28
29
|
end
|
29
30
|
|
data/plunk.gemspec
CHANGED
data/spec/last_spec.rb
CHANGED
@@ -55,4 +55,18 @@ describe 'the last command' do
|
|
55
55
|
lte: Time.now
|
56
56
|
}}}}.to_s)
|
57
57
|
end
|
58
|
+
|
59
|
+
it 'should parse foo=bar last 1h' do
|
60
|
+
result = @transformer.apply @parser.parse('last 1h foo=bar')
|
61
|
+
expect(result.query.to_s).to eq({
|
62
|
+
query: {
|
63
|
+
query_string: {
|
64
|
+
query: 'foo:bar'
|
65
|
+
},
|
66
|
+
range: {
|
67
|
+
'@timestamp' => {
|
68
|
+
gte: 1.hour.ago,
|
69
|
+
lte: Time.now
|
70
|
+
}}}}.to_s)
|
71
|
+
end
|
58
72
|
end
|
data/spec/nested_search_spec.rb
CHANGED
@@ -1,6 +1,25 @@
|
|
1
1
|
require 'spec_helper'
|
2
2
|
|
3
3
|
describe 'nested searches' do
|
4
|
+
before :all do
|
5
|
+
fake_results = {
|
6
|
+
foo: 'bar',
|
7
|
+
baz: 5,
|
8
|
+
arr: [ 0, 1, 2, 3 ],
|
9
|
+
'@timestamp' => Time.now
|
10
|
+
}.to_json
|
11
|
+
Plunk::ResultSet.any_instance.stub(:eval).and_return(fake_results)
|
12
|
+
end
|
13
|
+
|
14
|
+
it 'should transform' do
|
15
|
+
results = @transformer.apply @parser.parse('foo=`bar=baz|baz`')
|
16
|
+
expect(results.query).to eq({
|
17
|
+
query: {
|
18
|
+
query_string: {
|
19
|
+
query: 'foo:(5)'
|
20
|
+
}}})
|
21
|
+
end
|
22
|
+
|
4
23
|
it 'should parse a nested basic search' do
|
5
24
|
@parsed = @parser.parse 'tshark.len = ` 226 | tshark.frame.time_epoch,tshark.ip.src`'
|
6
25
|
expect(@parsed[:field].to_s).to eq 'tshark.len'
|